Collection
Let coding agents move fast inside a reviewable security boundary
Turn AI-assisted coding into an inspectable software-development workflow with bounded repository scope, untrusted-context handling, dependency checks, independent tests, protected build/CI surfaces, secret controls, egress limits and accountable human merge ownership.
20 elements · Explore in any order.
1 checklist · 5 principles · 14 protocols
20 elements
Draw the coding agent's execution surface before granting autonomy
The risk boundary is the set of things the agent can cause, not the chat window.
Read the idea PrincipleTreat issue and PR text as untrusted agent input
A familiar repository surface can still carry instructions for the model.
Read the idea ProtocolKeep agent code changes behind a branch and pull request
A reviewable boundary is cheaper than reconstructing an autonomous overwrite.
Read the idea ProtocolSet an allowed-file envelope before the agent starts
Review anchoring makes unrelated edits easy to miss when the requested fix looks correct.
Read the idea PrincipleProtect agent instruction files like build configuration
Plain text can be executable policy for the next agent run.
Read the idea ProtocolPut the real build and validation path in repository instructions
The repository should teach a new contributor how correctness is checked.
Read the idea ProtocolReview the file list before reading the agent's explanation
The diff knows what changed even when the summary forgets.
Read the idea ProtocolReview test changes independently from the code they excuse
Green can mean the test moved, not the bug.
Read the idea ProtocolAdd one adversarial case the coding agent did not propose
Agreement between generator and verifier can share the same blind spot.
Read the idea ProtocolVerify that an AI-suggested package actually exists and is the one you mean
A package name is an identifier in a supply chain, not a vocabulary guess.
Read the idea ProtocolAudit the version before merging an AI-added dependency
A real dependency can still be a known vulnerable dependency.
Read the idea PrincipleTreat build and install script changes as executable code
Configuration that runs automatically is code with excellent timing.
Read the idea ProtocolGive workflow changes their own approval gate
A workflow file can turn a code diff into privileged execution.
Read the idea ProtocolBlock secrets before they become repository history
Deleting a secret after merge is slower than never committing it.
Read the idea PrincipleRotate an exposed credential even after the text is removed
Deletion changes visibility; rotation changes validity.
Read the idea ProtocolConstrain the coding agent's network path
Network access turns local context into a possible exfiltration and supply-chain path.
Read the idea ProtocolAudit an MCP server before giving it repository context
A tool description is part of the agent's instruction and execution surface.
Read the idea PrincipleKeep CI agents away from production secrets they do not need
A pull request can become an instruction channel to a privileged deputy.
Read the idea ProtocolRequire a human decision before privileged workflow execution
The risky transition is not writing YAML; it is letting the YAML execute with privilege.
Read the idea ProtocolMake one human own the agent-generated change
Review is stronger when responsibility has a name.
Read the idea