Skip to main content
Alex can inspect Harness delivery health, diagnose failed executions, review Cloud Cost Management data, and author resources. CloudThinker requires approval before every create, update, or delete and cannot run, retry, or interrupt a pipeline.

​
Prerequisites

  • A Harness account with access to the organizations, projects, and Cloud Cost Management data you want CloudThinker to inspect.
  • A Harness personal access token (PAT) or service account token (SAT).
  • Permission to create a service account and role bindings if you use the recommended service-account setup.
Use an account-level service account when CloudThinker needs both project delivery data and account-level cost data. Limit its role bindings to the resource groups and actions you want agents to reach.

​
Setup

1

Create a Harness service account

In Harness, open Account Settings → Access Control → Service Accounts. Create a service account for CloudThinker, then assign role bindings for the organizations, projects, and account resources it should access.For personal testing, you can instead open your user profile and use My API Keys. A personal token inherits your own permissions.
2

Generate a token

Open the service account, select API Keys → API Key, and save a new key. Select Token under that key, set an expiration date, then select Generate Token.Copy the sat. token immediately. Harness displays it only once. A personal API key produces a pat. token through the same key-and-token flow.
3

Add the connection in CloudThinker

Navigate to Connections → Harness and enter:
  • API key: the PAT or SAT you generated.
  • Harness URL: keep https://app.harness.io unless your account uses another cluster or a self-managed installation.
  • Default organization: optional organization identifier applied to scoped requests.
  • Default project: optional project identifier. Set it only with a default organization.
Click Connect. CloudThinker saves the connection and shows a Connected status.
Harness displays a generated token only once. Store it securely and create a replacement if it is lost.

​
Connection details

Harness identifiers are not display names. Use the identifier shown in the Harness resource settings.

​
Required permissions

Harness tokens inherit permissions from their user or service account. Grant view permissions for every delivery or cost resource CloudThinker should inspect.
Start with view permissions. Add create, edit, or delete permissions only for resource groups where you want CloudThinker to author definitions.

​
Agent capabilities

Once connected, agents read live Harness state for each request. CloudThinker deliberately excludes pipeline execution controls. An agent cannot run, retry, or interrupt an execution, toggle a feature flag, sync a GitOps application, or approve a Harness approval step.

​
Verify the connection

​
Example prompts

​
Troubleshooting

The initial connection step does not validate the token. A revoked, expired, or incorrect token can therefore connect and fail on the first read. Generate a new token and reconnect.
The user or service account lacks a role binding for the requested scope. Check its Harness roles and resource groups, then narrow the request or grant the missing view permission.
The resource needs both an organization identifier and a project identifier. Set Default organization and Default project, or ask Alex to discover the identifiers before repeating the request.
Check that you supplied the resource identifier rather than its display name. Copy the identifier exactly as Harness shows it in the resource settings.
This is an intentional connection boundary. Open the pipeline in Harness to run, retry, or interrupt it. CloudThinker can inspect the execution and diagnose a failure without starting one.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Dedicated identity — prefer a service account so the connection does not inherit a person’s changing access.
  • Bounded role bindings — grant access only to the resource groups and operations agents need.
  • Token rotation — set an expiration date and replace the token before it expires.

CircleCI Connection

Pipeline status, workflow analysis, and gated controls

Approval

How CloudThinker gates agent write actions