Protocol
Require a human decision before privileged workflow execution
The risky transition is not writing YAML; it is letting the YAML execute with privilege.
When it fits
- An agent-generated PR would trigger Actions or another pipeline that can access secrets or mutate infrastructure.
When to avoid it
- Automated execution can be safe in carefully constrained environments; the requirement is a risk-appropriate authorization boundary, not manual clicking forever.
Why it matters
Before approving a privileged workflow run, inspect the workflow diff, trigger, permissions, external actions and commands. Make the approval a deliberate human step for untrusted or agent-authored changes unless a separately designed sandbox proves the run safe.
Steps
- Workflow content inspected.
- Requested permissions inspected.
- Secret exposure inspected.
- External actions pinned/reviewed.
- Commands understood.
- Human explicitly approves the privileged run.
An example
A Copilot PR changes `.github/workflows/release.yml`; Actions stay paused until a maintainer reviews the workflow and chooses to run it.
Check your result
No agent-authored workflow gains privileged execution solely because it exists in a PR.
Keep this limit in mind
- Automated execution can be safe in carefully constrained environments; the requirement is a risk-appropriate authorization boundary, not manual clicking forever.
Connected ideas
Use beforeMake one human own the agent-generated change
Evidence and sources
GitHub documentation says Copilot agent pull requests should receive the same thorough review as other contributions and warns reviewers to inspect workflow changes before allowing privileged Actions runs.
This is GitHub-specific implementation guidance; the general pattern is independent review before privileged execution.
Review output from Copilot · Review Copilot's changes; Manage GitHub Actions workflow runs
OWASP treats rules files, build scripts, CI workflows and package lifecycle scripts as security-sensitive control surfaces that deserve heightened review when an agent changes them.
The exact sensitive-file set depends on the repository and build system.
Secure Coding with AI Cheat Sheet · Rules Files; Prompt-to-Code Supply Chain Risk