{
  "schema": "vedokrok.public-item.v1",
  "release_id": "MHC-RPUB-20260920-75ad787a",
  "url": "/knowledge/require-a-human-decision-before-privileged-workflow-execution",
  "id": "MHC-D-RESEARCH-0669",
  "version": "0.1.0",
  "title": "Require a human decision before privileged workflow execution",
  "summary": "The risky transition is not writing YAML; it is letting the YAML execute with privilege.",
  "kind": "protocol",
  "body": "Before approving a privileged workflow run, inspect the workflow diff, trigger, permissions, external actions and commands. Make the approval a deliberate human step for untrusted or agent-authored changes unless a separately designed sandbox proves the run safe.",
  "limits": [
    "Automated execution can be safe in carefully constrained environments; the requirement is a risk-appropriate authorization boundary, not manual clicking forever."
  ],
  "topics": [
    "union-ai-assisted-coding-safeguards"
  ],
  "intents": [],
  "source_ids": [
    "RS-AF6C3AA11CD6EA39",
    "RS-1C68AE8325C384C0"
  ],
  "evidence": [
    {
      "claim": "GitHub documentation says Copilot agent pull requests should receive the same thorough review as other contributions and warns reviewers to inspect workflow changes before allowing privileged Actions runs.",
      "source_id": "RS-AF6C3AA11CD6EA39",
      "role": "supports",
      "note": "This is GitHub-specific implementation guidance; the general pattern is independent review before privileged execution.",
      "locator": "Review Copilot's changes; Manage GitHub Actions workflow runs"
    },
    {
      "claim": "OWASP treats rules files, build scripts, CI workflows and package lifecycle scripts as security-sensitive control surfaces that deserve heightened review when an agent changes them.",
      "source_id": "RS-1C68AE8325C384C0",
      "role": "supports",
      "note": "The exact sensitive-file set depends on the repository and build system.",
      "locator": "Rules Files; Prompt-to-Code Supply Chain Risk"
    }
  ],
  "use_when": [
    "An agent-generated PR would trigger Actions or another pipeline that can access secrets or mutate infrastructure."
  ],
  "avoid_when": [
    "Automated execution can be safe in carefully constrained environments; the requirement is a risk-appropriate authorization boundary, not manual clicking forever."
  ],
  "example": "A Copilot PR changes `.github/workflows/release.yml`; Actions stay paused until a maintainer reviews the workflow and chooses to run it.",
  "check": "No agent-authored workflow gains privileged execution solely because it exists in a PR.",
  "steps": [
    "Workflow content inspected.",
    "Requested permissions inspected.",
    "Secret exposure inspected.",
    "External actions pinned/reviewed.",
    "Commands understood.",
    "Human explicitly approves the privileged run."
  ],
  "sources": [
    {
      "id": "RS-AF6C3AA11CD6EA39",
      "title": "Review output from Copilot",
      "url": "https://docs.github.com/en/copilot/how-tos/copilot-on-github/use-copilot-agents/review-copilot-output"
    },
    {
      "id": "RS-1C68AE8325C384C0",
      "title": "Secure Coding with AI Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Secure_Coding_with_AI_Cheat_Sheet.html"
    }
  ],
  "relations": [
    {
      "from": "MHC-D-RESEARCH-0669",
      "to": "MHC-D-RESEARCH-0670",
      "type": "use_before",
      "url": "/knowledge/make-one-human-own-the-agent-generated-change"
    }
  ],
  "collections": [
    {
      "id": "RC-E25DB1788236EF13",
      "title": "Let coding agents move fast inside a reviewable security boundary",
      "url": "/collections/let-coding-agents-move-fast-inside-a-reviewable-security-boundary"
    }
  ]
}