Your account context, always ready

When you work across multiple IBM Cloud accounts, regions, and resource groups, repeating that context in every session adds friction. Paver builds a persistent picture of how you work, such as your preferred regions, the projects you return to, and the resources you manage most, and carries that context forward automatically. If your setup changes or Paver has something wrong, correct it by telling Paver in chat and it updates immediately. For more information about Paver's memory, see Building persistent memory and context.

Operating with safeguards

When you're managing enterprise workloads in IBM Cloud, staying in control of what Paver does and when is essential. You can set Paver to work in Safe mode, where Paver can't modify your resources. In Safe mode, Paver can still read your resources, diagnose problems, and read and write files in its sandbox, so you can safely explore your account and plan changes, such as creating scripts or Terraform to implement them. Paver can't run those scripts or apply those plans until you switch to Edit mode. When you're ready to act, switching to Edit mode means that Paver asks for your explicit approval before each operation runs, and you can modify the exact command before it executes.

Paver Guard adds a risk policy on top of this so you can set thresholds that auto-approve routine operations while holding higher-risk changes for your review, giving you fine-grained control that scales with how comfortable you are with the task at hand. For more information, see Managing safeguards and controls.

Bring your configs and artifacts into the conversation

Managing cloud infrastructure means working with many files, whether it's Terraform plans, Kubernetes manifests, deployment configs, or logs. Paver has a persistent file workspace so that you can upload the files that matter to a task, ask Paver to review or act on them, and download anything Paver generates. Your workspace persists across sessions so the files are there when you return. For more information, see Sharing files with Paver.

Keep your credentials out of the chat

Connecting Paver to your IBM Cloud services often requires working with API keys and service credentials. With the keyring, you can store those secrets once, export them, and then Paver injects them as environment variables at the start of each session so they're available when needed, without you ever pasting them into the chat. Paver encrypts stored values and doesn't display them after storage. When exported, any command in the conversation can read the value, so export only what you need. Entries expire on a schedule that you control, so credentials don't persist beyond their useful life. For more information, see Storing your secrets in the keyring.

Run IBM Cloud commands in the same environment Paver uses

When you need to go beyond chat to run a quick ibmcloud command, inspect a Kubernetes cluster, or verify a Terraform plan before applying it, Paver's shell puts you directly inside the environment Paver uses it to act on your behalf. It comes preinstalled with the IBM Cloud CLI, kubectl, helm, terraform, and standard scripting tools, all connected to your account. Open it with paver shell from your terminal or /shell from a chat session without losing your conversation context. For more information, see Using the interactive shell.

Skills that know your services

IBM® maintains a set of built-in skills for working in IBM Cloud, which works as domain-specific knowledge that Paver loads automatically based on what you ask, covering the right commands, correct sequences, and service-specific considerations for the task at hand. These are called system skills. You can also upload your own user skills to encode team-specific workflows, naming conventions, or organizational expertise. For more information, see Extending Paver with skills.