Set up deployments

Deployment setup builds from the runner outward. The Deployments area opens with a four-step checklist; each step unlocks the next.

Who can do this

Workspace Owners and Administrators. Deployments are hidden from other roles.

Execution gate

In the current release, execution is limited by a server-side gate that the people operating your installation control: production-tier environments cannot execute, only the Sandbox marker adapter can run, and each workspace, service, and environment must be allowlisted explicitly. You can plan and approve deployments for any method; queueing a run outside the gate is denied and audited. See Deployment model.

The four steps

1. Register a deployment runner. An isolated, outbound-only runner with only the deployment capabilities and network access it needs. It publishes the adapters it can execute and its immutable authority aliases. → Register a deployment runner and connections
2. Connect deployment authority. A connection binds an adapter to an authority alias the runner published. Credentials and resource restrictions stay on the runner.
3. Add an environment. Name the destination for one service, choose its tier and deployment method, bind connections, and decide its verification. → Create a deployment environment
4. Verify with a plan. Build an exact release plan and preview the immutable workflow before anyone approves or runs it. → Approve and run a deployment

After setup

• Roll back a release as a new reviewed plan.
• Reconcile an uncertain run when an outcome cannot be proven.
• Browse the adapter catalogue to see which operations exist and which a registered runner currently offers.