Protocol

Keep agent code changes behind a branch and pull request

A reviewable boundary is cheaper than reconstructing an autonomous overwrite.

When it fits

An agent can write directly to the shared default branch.

When to avoid it

Emergency processes may differ, but bypasses should be explicit, authorized and auditable rather than the default agent path.

Why it matters

Route nontrivial agent changes through a dedicated branch and pull request. Preserve the diff, checks and human review before merge. Protect the default branch with the same or stronger controls used for human contributions; AI authorship is not a bypass category.

Steps

Change has an isolated branch.
Full diff is visible.
Required checks run.
Human review occurs.
Protected branch rules still apply.
Merge is explicit.

An example

The agent opens a PR for a dependency fix rather than committing directly to main, even when the patch is only three lines.

Check your result

The default branch cannot receive the agent's nontrivial change without the normal review boundary.

Keep this limit in mind

Emergency processes may differ, but bypasses should be explicit, authorized and auditable rather than the default agent path.

Connected ideas

Evidence and sources

Supports

GitHub documentation says Copilot agent pull requests should receive the same thorough review as other contributions and warns reviewers to inspect workflow changes before allowing privileged Actions runs.

This is GitHub-specific implementation guidance; the general pattern is independent review before privileged execution.

Review output from Copilot · Review Copilot's changes; Manage GitHub Actions workflow runs

Supports

NIST SSDF recommends integrating secure development practices into the software lifecycle rather than treating security as a separate late-stage review.

The framework is high-level and must be tailored to the organization's development model and risk.

Secure Software Development Framework (SSDF) Version 1.1 · SSDF overview

All sources (2)