How are runner permissions handled?

Last updated: May 21, 2026

ANSWER

You define the IAM permissions boundary in your app config. The customer can grant or revoke at will, or turn the runner off entirely between release windows. Permissions can also be temporarily elevated via break-glass.