Governance, Safety, and Reliable Delivery with Agents
Accountability does not delegate
An agent acts under a human's or an organisation's identity, and the approving human owns the outcome. Governance therefore needs named owners per agent, a documented purpose and scope, least-privilege credentials, and an audit trail that answers "what produced this commit and who approved it" - commit provenance, PR history, and the organisation audit log.
Separation of duties
No agent may approve or merge its own pull request; required reviews must come from a human or a distinct identity. Enforce this with branch protection and environment required-reviewers, not with convention.
Prompt injection is the core threat
Issue bodies, PR comments, README files, dependency metadata, and fetched web pages are untrusted input. Mitigations: treat all fetched text as data rather than instructions, keep the tool allowlist narrow, avoid combining broad read-of-arbitrary-URLs with write access to code, and require human approval before actions with side effects outside the repository.
Supply chain and delivery safety
Pin actions to commit SHAs, run code scanning and dependency updates continuously, sign or attest build artifacts, and gate releases behind progressive rollout with automatic rollback plus a kill switch - a single label or repository variable that halts all agent runs immediately.
Traps
- "A scanner ran, so it is secure." Scanning finds known patterns; it does not review logic.
- Secrets pasted into prompts or instruction files, where they end up in logs and conversation history.
- No offboarding: agents retain tokens after the pilot ends.
- Trusting agent-written PR descriptions as accurate summaries of the diff.
Rule of thumb
Write every agent's permissions as if the token will leak tomorrow: it should be worthless outside one repository and one task.