Implementation BlueprintExecution layer

Permaura Agent Permission Gateway Rollout (7-10 days)

A delivery playbook for standing up a Permaura gateway per client, wiring one sensitive workflow (Stripe refunds, Gmail sends) behind device-signed approvals, and handing over a signed audit trail the client can show their own compliance reviewer. Time: 7-10 days.

By InnovaAI ResearchPublished

AI Agents

How do you implement it?

Blueprint

Permaura Agent Permission Gateway Rollout (7-10 days)

A delivery playbook for standing up a Permaura gateway per client, wiring one sensitive workflow (Stripe refunds, Gmail sends) behind device-signed approvals, and handing over a signed audit trail the client can show their own compliance reviewer.

Prerequisites
  • Client has at least one MCP-compatible assistant in use (Claude, ChatGPT, Codex, or Cursor) and a named owner for approval decisions
  • Written inventory of the client apps to connect (Stripe, GitHub, HubSpot, Slack) plus which credentials currently sit in plaintext or shared vaults
  • A named approver with a phone, desktop, or Apple Watch available for device-signed approvals during business hours
  • Decision on gateway hosting: client-hosted open-source gateway, Permaura-hosted gateway, or bring-your-own tunnel
  • Agreement on which actions are allow, require approval, or deny before any credential is moved into the gateway
Execution Timeline
  • 1.Register the Permaura workspace and choose the hosting path: local open-source gateway, Permaura-hosted gateway, or bring-your-own tunnel
  • 2.Inventory the client's app credentials and flag every key currently pasted into a prompt, doc, or shared note
  • 1.Deploy the gateway and confirm it is reachable from the client network
  • 2.Connect the first MCP-compatible assistant (Claude, ChatGPT, Codex, or Cursor) and verify a read-only request round-trips
  • 1.Move Stripe and GitHub credentials into the gateway so the assistant never holds raw keys
  • 2.Confirm the assistant can list resources but cannot mutate anything yet
  • 1.Map the first sensitive workflow end to end, for example refunds in Stripe or message sends in Gmail
  • 2.Draft the per-connection rule set: which calls are allow, which require approval, which are deny
  • 1.Load the rules into Permaura and test each branch with a live but low-value request
  • 2.Enroll the client approver's phone and desktop for device-signed approvals and run one approval from each
  • 1.Connect the remaining apps (HubSpot, Slack) under the same policy pattern
  • 2.Walk the client through the approval prompt so they see exactly what the agent is asking to do
  • 1.Review the signed audit trail for the week and check every request and decision is linked
  • 2.Tighten any rule that produced an approval prompt the client did not expect
  • 1.Write the handoff guide: rule table, approver roster, escalation path for a denied action
  • 2.Record a short screen capture of a denied request and how to override it deliberately
  • 1.Train the client team on approving sensitive actions and on reading the audit trail
  • 2.Run a tabletop drill where the agent attempts a refund above the client's threshold
  • 1.Hand over the workspace, export the audit trail as the baseline record, and set the review cadence
  • 2.Agree the retainer scope for policy changes and new app connections
$0 to $19 per month in Permaura subscription during the build (Free plan at $0, Pro at $19 monthly or $15.83 monthly billed annually, Team at $19 per seat), plus 20 to 30 delivery hours; the productized setup is priced at $2,250 per client.7-10 days
ROI Logic

A single client rollout bills at $2,250 against a Permaura subscription that costs $0 on the Free plan or $19 monthly on Pro, so the tool cost is a rounding error next to the delivery fee. The margin holds because the work is policy design and approval training, not software licensing, and each additional client reuses the same rule pattern across Stripe, GitHub, HubSpot, and Slack. Team seats at $19 per seat only enter the picture when the agency runs several client workspaces from one account.

Deliverables
  • Configured Permaura gateway with client app credentials stored inside it rather than in prompts
  • Per-connection policy table listing every allow, require-approval, and deny rule with the business reason for each
  • Approver roster with enrolled devices for device-signed approvals and an escalation path for denied actions
  • Exported signed audit trail covering the build window as the client's baseline record
  • Handoff guide plus recorded walkthrough of an approval and a deliberate override
Definition of Done

The client's assistant completes one sensitive action only after a device-signed approval, and the signed audit trail shows the request, the decision, and the approver in a single linked record.

Open the Permaura coursePermaura decision recordBrowse the Academy

More on Permaura

More for AI Agents