InstaCloud

Agent execution mode (managed Platform)

agent-policy is the only policy system. Humans use normal RBAC; only agent requests enter the policy evaluator. The former policy command and approval --always flag have been removed.

Always use insta --agent <command> … when invoking the CLI as an agent, including setup and read-only commands. Examples include the global flag explicitly; with npx, use npx -y insta@latest --agent <command> …. Do not rely on environment detection alone. Commands explicitly marked for a human admin are relay instructions, not agent tool calls: never execute them yourself or remove --agent to bypass a restriction. First run insta --agent setup agent in the linked project (or --project <id> / --create <name>). This stores a project-bound, 24-hour session in .insta/agent-session.json, automatically ignored by Git. It supplements the existing user login. Missing, expired, revoked or wrong-project sessions fail with setup guidance; never retry a rejected agent request without --agent.