01 / Principal and identity
Who acts, and what can the platform identify?
A coding agent uses an app installation or token under a repository owner’s task.
GitHub App installation and permissions establish API access to selected repositories.
- 01Originating task
- 02Agent or workload
- 03It pushes a commit or opens a pull request.
- 04Observed effect
02 / Action-time control
Where can an unauthorized effect be stopped?
Place checks in the tool wrapper and enforce branch protection/rules at GitHub.
Bind repository, branch, file scope, operation and task approval.
Delegation constraint
A helper agent should receive a narrower repo/task grant than the coordinator.
03 / Worked denial
Test a request outside the grant.
An agent assigned documentation tries to push workflow changes to the default branch.
Adversarial verification
Give a documentation agent installation access, then have it attempt a workflow-file edit and a default-branch push. Check the tool scope and repository rules independently.
04 / Review and responsibility
What should the audit trail prove?
Installation ID, actor/run, repo, branch, changed paths, decision, commit/PR and rule result.
A tool wrapper cannot bypass GitHub’s own repository rules and should not claim to.
Platform primary source