# Check build and run access separately

Hosted generation and hosted invocation are independently controlled capabilities. Being able to edit a plan or inspect a version does not prove that either cloud operation is enabled.

## Read the account boundary

Use the signed-in account read, `GET /hvy/v1/account`, and examine `services`. `services["cloud.loops.build"] === true` permits the hosted build path; `services["cloud.loops.run"] === true` is the separate run capability. Read the actual boolean value rather than treating a successful sign-in as entitlement.

The account comes from the authenticated session. Do not supply someone else's account ID or transfer credentials between browser, native and terminal session authorities. A false capability is not repaired by calling an alternate undocumented route.

## Match permission to the action

Writing or retaining a local draft is not a hosted build. Generating a candidate needs build access and consent to process the brief. Invoking an approved artifact needs run access, explicit inputs and invocation consent. An approved version can exist while run access is unavailable.

A governed runtime connection has its own identity, catalogue and policy checks. Its source interface is not evidence that a hosted account flag enabled that separate execution track.

## Check without starting work

Read the flags and retain only the non-secret result. Do not start a paid run to test whether a permission is present. If access is false or refused, keep the plan unexecuted and review [shared account guidance](/docs/shared/account).

For subscription or frozen-account refusals, inspect the actual account state rather than changing keys, permissions or plans as a troubleshooting shortcut. See [cloud consent](/docs/loop-builder/cloud-consent-and-policy-limits) for the separate authorization fields.

## Related reading

[MDN: HTTP 202 Accepted](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/202) explains why request acceptance is not completion. Use the owning Loop run record to establish the actual execution state.