Principle
Protect agent instruction files like build configuration
Plain text can be executable policy for the next agent run.
When it fits
- An agent or contributor can casually change AGENTS.md, Copilot instructions or similar steering files.
When to avoid it
- Instruction files improve behavior but cannot enforce access control; do not store secrets or rely on them as the only safety mechanism.
Why it matters
Include agent instruction and rules files in sensitive-file review. Require explicit approval for changes, show their diff prominently and prevent the agent from silently weakening its own constraints. Keep security authorization outside these files.
An example
A PR that edits application code and also removes the 'do not modify workflows' instruction gets a separate security review.
Check your result
Persistent steering changes cannot hide inside an ordinary feature diff.
Keep this limit in mind
- Instruction files improve behavior but cannot enforce access control; do not store secrets or rely on them as the only safety mechanism.
Connected ideas
Useful withPut the real build and validation path in repository instructions
Evidence and sources
OWASP treats rules files, build scripts, CI workflows and package lifecycle scripts as security-sensitive control surfaces that deserve heightened review when an agent changes them.
The exact sensitive-file set depends on the repository and build system.
Secure Coding with AI Cheat Sheet · Rules Files; Prompt-to-Code Supply Chain Risk
GitHub repository instructions can provide agents with project-specific build, test and validation guidance, including repository-wide, path-specific and AGENTS.md instructions.
Instruction files improve context but are not a security boundary or substitute for permissions.
Adding repository custom instructions for GitHub Copilot · Repository custom instructions