Agent run configurations and approvals

Agents never get your Jenkins credentials and never see your whole server. They can only request the run configurations you create in AI Agents → Run Configurations — and you decide how much freedom each one grants.

Creating a configuration

A configuration ties together:

• A Jenkins pipeline — a job, or a multibranch project combined with a branch rule (see below).
• A name and key — the key (e.g. metatarif-deploy-dev) is the ID agents use.
• A Git repository — by default a configuration is restricted to one repository: agents only see it while working in a checkout whose origin matches. Switch off "Restrict to a Git repository" to make it available anywhere (this defaults the configuration to requiring approval).
• Approval mode — run automatically, or ask you first.

Multibranch pipelines

For a multibranch project you select the project itself and control the branch separately, just like a parameter:

• Fixed — pick one branch from the project's current branches; agents always build that branch.
• Agent chooses — provide a full-match regular expression such as main|develop or feature/.+; the agent names the branch through the branch input, and only matching branches that exist on Jenkins can be built.

When the agent chooses, the parameter list below is read from the project's default branch. At request time BuildCaptain compares the chosen branch's parameters against the configuration and rejects the request if they differ — a branch with a diverging Jenkinsfile cannot slip past your rules.

Parameter rules

Every build parameter is either fixed (you set the value; the agent cannot change it) or agent-chosen within limits you define:

• Choice parameters: tick which of the job's choices are allowed.
• String parameters: list allowed values, or provide a full-match regular expression.
• Booleans: the agent may pick true or false.
• Free-form text and password parameters can never be agent-chosen.

BuildCaptain also fingerprints the job's parameter schema: if the Jenkins job's parameters change, the configuration stops matching until you review it — an agent can never exploit a drifted form.

The approval flow

When a configuration requires approval, an agent's request appears at the top of the Activity page (and as a notification) showing who asked, from which repository and branch, and with which inputs. Approve or reject with one click. Requests expire automatically after 10 minutes.

The audit trail

Every agent operation — requested, approved, rejected, queued, running, completed, failed — is kept in the Agent Run History on the Activity page, with the caller, repository, and inputs.

Setup for agents

Agents connect through the open-source CLI — see Install the BuildCaptain CLI.