{
  "schema": "vedokrok.public-item.v1",
  "release_id": "MHC-RPUB-20260920-75ad787a",
  "url": "/knowledge/protect-agent-instruction-files-like-build-configuration",
  "id": "MHC-D-RESEARCH-0655",
  "version": "0.1.0",
  "title": "Protect agent instruction files like build configuration",
  "summary": "Plain text can be executable policy for the next agent run.",
  "kind": "principle",
  "body": "Include agent instruction and rules files in sensitive-file review. Require explicit approval for changes, show their diff prominently and prevent the agent from silently weakening its own constraints. Keep security authorization outside these files.",
  "limits": [
    "Instruction files improve behavior but cannot enforce access control; do not store secrets or rely on them as the only safety mechanism."
  ],
  "topics": [
    "union-ai-assisted-coding-safeguards"
  ],
  "intents": [],
  "source_ids": [
    "RS-1C68AE8325C384C0",
    "RS-9C63048CEC01BF7C"
  ],
  "evidence": [
    {
      "claim": "OWASP treats rules files, build scripts, CI workflows and package lifecycle scripts as security-sensitive control surfaces that deserve heightened review when an agent changes them.",
      "source_id": "RS-1C68AE8325C384C0",
      "role": "supports",
      "note": "The exact sensitive-file set depends on the repository and build system.",
      "locator": "Rules Files; Prompt-to-Code Supply Chain Risk"
    },
    {
      "claim": "GitHub repository instructions can provide agents with project-specific build, test and validation guidance, including repository-wide, path-specific and AGENTS.md instructions.",
      "source_id": "RS-9C63048CEC01BF7C",
      "role": "supports",
      "note": "Instruction files improve context but are not a security boundary or substitute for permissions.",
      "locator": "Repository custom instructions"
    }
  ],
  "use_when": [
    "An agent or contributor can casually change AGENTS.md, Copilot instructions or similar steering files."
  ],
  "avoid_when": [
    "Instruction files improve behavior but cannot enforce access control; do not store secrets or rely on them as the only safety mechanism."
  ],
  "example": "A PR that edits application code and also removes the 'do not modify workflows' instruction gets a separate security review.",
  "check": "Persistent steering changes cannot hide inside an ordinary feature diff.",
  "sources": [
    {
      "id": "RS-1C68AE8325C384C0",
      "title": "Secure Coding with AI Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Secure_Coding_with_AI_Cheat_Sheet.html"
    },
    {
      "id": "RS-9C63048CEC01BF7C",
      "title": "Adding repository custom instructions for GitHub Copilot",
      "url": "https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/add-custom-instructions/add-repository-instructions"
    }
  ],
  "relations": [
    {
      "from": "MHC-D-RESEARCH-0655",
      "to": "MHC-D-RESEARCH-0656",
      "type": "useful_with",
      "url": "/knowledge/put-the-real-build-and-validation-path-in-repository-instructions"
    }
  ],
  "collections": [
    {
      "id": "RC-E25DB1788236EF13",
      "title": "Let coding agents move fast inside a reviewable security boundary",
      "url": "/collections/let-coding-agents-move-fast-inside-a-reviewable-security-boundary"
    }
  ]
}