Give an agent GitHub access without letting it merge or leak code

Source code is crown-jewel data, and a merge or a public repo is a one-call mistake. Keep the agent to drafts and keep secrets out of commits.

For: Engineering and platform teams running an agent against GitHub

GitHub holds the most sensitive asset an agent can reach — the source itself — and two of its actions are effectively irreversible in the ways that matter: merging a change, and making a private repo public. Both are a single tool call.

These ingress policies keep the agent in a draft-and-propose lane. require-human-approval-merge lets it open and review but never consummate a merge; deny-public-exposure-repos blocks flipping a repo, gist, or page to public and forces private: true. block-secrets-commits denies commits whose contents carry live credentials, and fence-scopes-org-allowlist keeps the agent inside your own organizations rather than pushing to arbitrary destinations. For reads, redact-secrets-egress masks tokens and keys that already sit in the tree before they reach the model.

The result maps cleanly onto change-management expectations: an agent can draft the work, but a human still owns the merge and nothing goes public by accident.