05 from AI Agent Governance — One Engineer, Over a Hundred Repositories and the Decisions No Agent Makes
Decision rights for AI agents when nobody reviews
Required reviews assume a second person, and required checks assume a rule in every repository that names the right job and stays current. A maintainer working with agents often has neither.
This procedure decides, before the agents start, which decisions stay with a person and which a check may make, and holds each one with configuration rather than trust.
- 1
Write down what stays human
Money, publication and anything that cannot be undone. The person whose account the agents commit under owns the list; the security lead signs it off.
- 2
Hold history with one ruleset
Every default branch gets the same ruleset, with the rules
non_fast_forwardanddeletion, applied throughgh apitorepos/{owner}/{repo}/rulesets. - 3
Hold money with a budget action
AWS Budgets attaches a deny-all policy to the role that creates resources once the month's actual cost crosses a ceiling; the EKS platform's bootstrap sets thirty dollars.
- 4
Keep keys out of reach
Model and cloud access both come from workload identity federation, so no key is stored to leak. A token reaches a command line on standard input from the keychain, never as an argument.
- 5
Let the verification decide the merge
Replace
gh pr merge --autowith a workflow started by the verification's completion (on: workflow_run) that merges only when it concluded success, then starts the verification again on main, because a push made withGITHUB_TOKENstarts no workflows. - 6
State the cooldown
Write
cooldown: default-days: 3intodependabot.yml, so shortening the three-day wait is a visible diff, and fail any repository that shortens it. - 7
Show every gate its violation
Plant the change each check must refuse, run the plants daily, and fail the build when a check stays quiet or refuses for the wrong reason. Publish what still gets through.
Who decides what
| Decision | Held by | Owner |
|---|---|---|
| Merge a dependency update | The verification's own success on that commit | Platform team |
| Spend | A budget action that attaches deny-all at the ceiling | The account owner |
| Publish | A person's go-ahead; no pipeline publishes on its own | The person named on the list |
| Rewrite or delete history | A ruleset: no force-push, no deletion | The repository owner |
| Shorten the cooldown | A fleet rule that fails the repository | Platform team |
| Trust a check | A planted violation it has to name | SRE, with the security lead reading every miss |
What shows it works
Each is a public file at a pinned version, or a page that counts it live.
- GitHub CLI v2.97.0, merge.go, lines 763 to 766: the states in which
--automerges at once, unstable among them. - The fleet's auto-merge workflow, commit 3831f323, 18 September 2026: it merges only on the verification's success and verifies main again after the merge.
- The EKS platform's bootstrap: AWS Budgets attaches deny-all to the creation role at thirty dollars of actual monthly cost (ADR 10).
- The evidence page, who decides what: the planted violations and the decisions that stay with a person, counted live.
The reproduction ran in a private test repository; the source line and the workflows are public. Holding decisions this way costs speed where speed is dangerous: an update opened while verification is broken waits for a person, and OpenSSF Scorecard's code-review check stays at zero.
Capability is the vendor's problem. Decision rights are yours.
The long version is the post AI Agent Governance. GitHub Docs, Automating Dependabot with GitHub Actions; GitHub Docs, pull request merge states; GitHub Changelog, default package cooldown, 14 July 2026.