Talk to us about a pilot

Hand off the work, not the keys.

Agents propose. People approve. Relevo applies.

Relevo is a team workflow for delegating infrastructure work to AI agents. The agent runs off your laptop, under its own read-only identity, where the whole team can see it. Nothing changes in production until a person approves the exact plan, and a separate component applies it.

Talk to us about a pilotSee how approval works

Status: in design. There is nothing to install yet.

t-142needs approval

Find out why checkout has been restarting since 14:00

Delegated by
ana
Agent
Claude Code
Scope
payments-prod · production
Identity
its own, read-only

Plan p-31 · 2 operations

expires in 26 min

Reason, from the agent: Confirm the heap growth and keep checkout serving while the limit fix (PR #482) is reviewed.

  1. 1execpod/checkout-7d9f8c6b5-x2x9kjcmd 1 GC.heap_info
  2. 2scaledeployment/checkoutreplicas 3 → 5

namespace checkout · cluster prod-us-east1 · frozen 14:04:05 UTC · sha256:9f2c…e1a7

Approve planReject

Approving applies these 2 operations once, through the executor. The agent never gets write credentials.

Design preview: a task waiting for approval. Nothing here is running.

The problem

Today the agent has your keys.

An agent on your laptop works with your credentials: your cloud session, your cluster contexts, your GitHub token. Nobody else on the team can see what it is doing, or whether someone is already on the same thing. The rule “propose and wait for my OK” holds only while the agent obeys it. And when the laptop sleeps, the task dies halfway.

How it works

One task, from delegate to close.

Follow task t-142 through the design. At every step its state is a symbol, a word and a color.

  1. 01Delegate

    You start the task from the terminal, with the agent you already use, and name the scope: which systems, which environment.

    starting

  2. 02Identify

    The task gets its own identity, derived from yours but read-only, with short-lived credentials. None of your credentials are copied.

    starting

  3. 03Run

    It runs in an environment in your cluster that exists only for this task. Close the laptop; it keeps going.

    running

  4. 04See

    It shows up on the team board: who delegated it, what it touches and what it has read so far.

    running

  5. 05Approve

    When it needs to change something, it stops and sends the exact plan. A person approves outside the agent.

    needs approval

  6. 06Hand off

    When it has a question, it waits. A teammate can answer it, pause it or stop it, with the context already there.

    needs input

  7. 07Close

    What was done, what changed and what the agent read stay on record. The credentials expire and the environment is destroyed.

    closed

The seven states

  • starting

    The environment is being created and credentials issued.

  • running

    The agent is working.

  • needs approval

    A plan is waiting for a person.

  • needs input

    The agent stopped with a question.

  • paused

    Stopped on request, or because a plan expired or a limit was reached. The environment stays up.

  • aborted

    Interrupted without anyone asking. It says what completed and what did not.

  • closed

    Finished. It says how: completed, stopped or failed.

Approval

Approval happens outside the agent.

The agent never holds write credentials. That is the whole mechanism: it cannot apply what it proposes, so asking first is not something it can forget.

  1. The agent stops.

    It hits a permission it does not have, builds a plan from a closed catalog of operations, sends it and stops.

  2. You see the exact plan.

    Each operation with its target and parameters, the scope and the environment, on the board and in Slack. The plan is frozen when it is sent.

  3. A person approves.

    Someone named as an approver for that scope, from outside the agent. Who and when are recorded.

  4. The executor applies that and nothing else.

    A separate component gets a short-lived write credential for that scope, runs those operations once and returns the result to the agent.

14:03:52  denied    exec in pod/checkout-7d9f8c6b5-x2x9k (no write credentials)
14:04:05  plan      p-31 sent · 2 operations · frozen
t-142   needs approval  waiting for an approver of payments-prod
14:09:12  approved  by luis, from Slack
14:09:14  executor  1/2 exec   pod/checkout-7d9f8c6b5-x2x9k   ok
14:09:15  executor  2/2 scale  deployment/checkout            ok
14:09:15  executor  write credential expired
t-142   running         the agent continues with the result
>
Design preview: the same plan, followed from the terminal with relevo attach.

  • One approval, one plan.

    An approval covers the whole plan, not each operation.

  • Plans expire.

    A plan nobody decides on expires after 30 minutes. The system may have changed.

  • One attempt.

    Nothing is retried on its own. If the result is unknown, the plan says so.

  • A closed catalog.

    Restart, scale, delete a pod, run a command in a pod. Terraform keeps going through a pull request and Atlantis.

Interfaces

From where you already work.

Terminal

The daily entry point. Delegate, list the team's tasks, ask who is already on something, attach to follow one live and talk to the agent. Detaching does not stop the task.

$ relevo run --scope payments-prod "find out why checkout has been restarting since 14:00"
t-142   starting        scope payments-prod · identity read-only
t-142   running         environment ready in 38s
Follow it with: relevo attach t-142. Closing the terminal does not stop the task.
$ relevo ls
ID     STATE             DELEGATED BY  SCOPE          AGE  TASK
t-142   needs approval  ana           payments-prod  12m  why checkout has been restarting
t-139   needs input     luis          infra-staging  41m  payments node pool to larger machines
t-144   running         mei           payments-prod  3m   check PR #482 against the incident
t-128   closed          ana           payments-prod  1d   why the 02:00 batch finished late
$ relevo who checkout
t-142   needs approval  ana           payments-prod  12m  why checkout has been restarting
t-137   paused          luis          payments-prod  2h   checkout config, staging vs production
Design preview. Command names are provisional.

Slack

The approval request arrives with the plan and two buttons. Whoever delegated a task hears when it needs them, when it is cut off and when it closes.

RelevoApp14:04

needs approvalPlan p-31 is waiting for you

t-142 · Find out why checkout has been restarting since 14:00

Delegated by @ana · Claude Code · payments-prod (production)

Reason: Confirm the heap growth and keep checkout serving while the limit fix (PR #482) is reviewed.

1. exec   pod/checkout-7d9f8c6b5-x2x9k   jcmd 1 GC.heap_info
2. scale  deployment/checkout            replicas 3 → 5

Expires in 26 min · Approvers: @ana @luis @mei · Applies once, through the executor.

Approve planReject
Design preview. Nothing here is running.

Team board

Every task of the team in one list: its state, who delegated it, what scope it has. Tasks that need approval come first.

StateIDTaskDelegated byAge
needs approvalt-142Find out why checkout has been restarting since 14:00ana12m
needs inputt-139Move the payments node pool to larger machines and leave the PR readyluis41m
runningt-144Check PR #482 against what the incident showedmei3m
startingt-145List service accounts unused for 90 daysana10s
closedt-128Find out why the 02:00 batch finished lateana1d
Design preview. Nothing here is running.

Limits

What Relevo controls, and what it does not.

Where control is partial, the product says so instead of implying a guarantee.

Relevo controls

  • The agent cannot apply.

    It has no write credentials. It reads, and it can open branches and pull requests.

  • The agent cannot skip approval.

    Approval happens outside the agent, and a different component applies.

  • The plan cannot change after approval.

    It is frozen when sent. The executor reads it from the control plane, not from the agent.

  • The plan cannot hide more than it shows.

    No free-form commands: only catalog operations, with targets the server resolves.

  • Who did what stays on record.

    Who delegated, who approved and what was applied, under an identity that is not yours.

Relevo does not control

  • Someone approving without reading.

    Plans are short and exact. Reading them is still a person's job.

  • Everything the agent can read.

    The read-only identity excludes cluster secrets and the secret manager. Secrets that show up in logs or Terraform state are still readable.

  • Text that steers the agent.

    A malicious log line or ticket can redirect it. It still cannot apply anything, but it can read what its identity allows and write it into a pull request.

  • Other systems with more permissions.

    A push or a comment can trigger a pipeline that applies on its own. Closing those paths depends on your setup; installing Relevo includes a checklist for them.

  • People and laptops.

    Relevo does not stop a person acting with their own permissions, or an agent still running on a laptop with them.

Pilot

Run the first pilot with us.

Relevo is in design, and there is nothing to install yet. We are looking for a few platform teams on GKE to run the first pilot and tell us where it falls short.

Talk to us about a pilotpilot@relevo.build