# Bot {#bot-overview}

A **bot** is a non-human principal in a Shisho Cloud organization. Like a user, a bot can be assigned organization roles and act on the organization's resources; unlike a user, it has no email address or password, and it is meant to be driven by automation rather than a person.

## When to use a bot {#when-to-use}

Create a bot whenever a script, CI/CD pipeline, or another service needs to call Shisho Cloud without a person clicking through a browser sign-in. Typical cases:

- Deploying and syncing workflows (audit rules) between a Git repository and Shisho Cloud, as in [Managing Rules with SCM](/docs/g/getting-started/deploy-policies-with-git-repositories/index.md).
- Minting per-developer registry tokens for [Takumi Guard's admin deployment](/docs/t/guard/features/admin-deployment/index.md).
- Any other unattended, programmatic access to Shisho Cloud through the [shishoctl CLI](/docs/c/accessing-via-shishoctl-cli/index.md) or its API.

Using a bot instead of a shared personal account keeps automation access auditable and independently revocable. You can scope a bot's roles to exactly what the automation needs, and rotate or delete its credentials without touching any human's account.

## How a bot fits Shisho Cloud {#how-it-fits}

A bot is created and managed at the organization level, from the [bots list](https://cloud.shisho.dev/*/settings/bots) page in organization settings. Once created, it behaves like any other organization principal:

- **Roles** - Assign it one or more [organization roles](/docs/c/iam/permission.md#organization-roles), the same roles you'd assign to a user or a team. Grant only what the automation needs — for example, the least-privilege `organization/takumi_guard_token_issuer` role for a bot that only mints Guard tokens.
- **Authentication** - A bot signs in through a machine-friendly path instead of a browser: a static API key, or an OIDC ID token exchanged with GitHub Actions, GitLab CI, or any other OIDC-Discovery-compliant identity provider. See [Authentication](/docs/c/bot/authentication.md) for how to set each of these up.

## Next steps {#next-steps}

- [Authentication](/docs/c/bot/authentication.md) - choose and configure how your bot signs in.
- [shishoctl CLI](/docs/c/accessing-via-shishoctl-cli/index.md) - the tool most bots use to operate on Shisho Cloud once signed in.
- [Roles and Permissions](/docs/c/iam/permission.md) - the full list of organization roles you can assign to a bot.