Thora Cloud is built so that AI agents can operate real infrastructure through the Model Context Protocol. That raises an obvious question: how much should an agent be allowed to do on its own? Our answer is a single, legible boundary.
Where the line sits
Agents are free to do the preparatory work. They can read a repository, commit changes to a private agent branch, and build an isolated, signed-in preview of a site. None of that is visible to the public, and all of it can be reviewed or discarded.
Anything that crosses into the public, such as promoting a build to a live domain or connecting a new hostname, becomes a request. It waits in the organization's queue until an administrator approves it, and it expires if nobody does.
Pinned to what was reviewed
An approval is only meaningful if it applies to exactly what was reviewed. Publication requests therefore name the specific commit and deployment they would promote, along with the live state they expect to replace. If anything changes underneath the request, it no longer matches, and nothing is promoted by accident.
Why this shape
The boundary keeps the fast, repetitive parts of shipping in the agent's hands while reserving judgement for a person. It also keeps accountability simple: every change that reached the public has a named approver. We think this is the right default for agent-operated infrastructure, and we expect to refine it as we learn from the teams in our private beta.