Hey, good clarification. “With my approval” really is the key part here, and the line is pretty much where you drew it.
Today we already have pieces of this:
- Auth is done once via the service CLI itself
wrangler login,gh auth login. The agent does not store or create long-lived creds. It works on top of the session you already granted, which is stored by the CLI tool itself, not Cursor. - Run Modes let you control what the agent can run on its own vs what requires approval. Default is auto-review, plus a terminal allowlist and per-action approval for MCP. Overview: Agent Security | Cursor Docs and Model Context Protocol (MCP) | Cursor Docs
Important security note specifically for deploys: Cursor allowlist and autoRun are meant as best-effort convenience, not a security guarantee, and the docs say that. Also, Run Everything bypasses all screening. So they are great UX controls to reduce routine work, but you should not treat them as a hard security boundary around deploys.
What you describe next, TTL, spend or request limits, audit log, easy revoke focused on deploys as a separate safer handoff layer, is not available as one unified layer yet. There is an FR looking in that direction for more granular approval options: Granular approval options for terminal commands and MCP tool calls. It makes sense to upvote it and add concrete scenarios, especially TTL, revoke, and audit as clear requirements.
So the answer to “is one-time CLI auth enough” is: for one-off projects it is enough for many users, but for repeat small deploys, a revocable, scoped, auditable handoff is what is missing. It is a votable direction, not a closed question.