---
title: "Run agents in CI only for trusted people · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/ci-agents-trusted-triggers
id: AID-29
level: Required
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 980
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Run agents in CI only for trusted people

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AID-29
- Level: Required
- Chapter: [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)
- Rule: An agent in CI starts only for people with write access to the repository. Its job holds no secrets it does not need.
- Check: From a test account without write access, open an issue that mentions the agent. The job does not start, and the log names the refusal.
- Risk: An account or system taken over
- How: Anyone can write an issue or a fork pull request, and the agent reads it as instructions. Check the author's permission before the agent starts. Give the job a read-only token and let it propose changes only as a pull request for review. Never run it on `pull_request_target` with code from a fork. See [keep build secrets from forks](https://agentwranglers.se/playbook/application-security/supply-chain/ci-secrets.md). Text from issues and pull requests never goes into the job's shell commands, as [Keep untrusted text out of CI scripts](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/ci-script-injection.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### YAML example

```yaml
on:
  issue_comment:
    types: [created]
permissions:
  contents: read
  pull-requests: write
jobs:
  agent:
    if: contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@<full-commit-hash>
      - run: ./run-agent.sh   # opens a pull request, never pushes to main
```

## Sources

- [GitHub Docs, secure use reference](https://docs.github.com/en/actions/reference/security/secure-use)
- [Claude Code GitHub Actions](https://code.claude.com/docs/en/github-actions)

## Related rules

- AID-72 [Keep publishing rights away from agents](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/no-publish-rights-for-agents.md) in AI-assisted development
- APS-74 [Keep secrets out of builds from strangers](https://agentwranglers.se/playbook/application-security/supply-chain/ci-secrets.md) in Application security
- ENG-41 [Keep untrusted text out of CI scripts](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/ci-script-injection.md) in Engineering
- AID-64 [Let background agents deliver only pull requests](https://agentwranglers.se/playbook/ai-assisted-development/running-agents-at-scale/background-agents-open-pull-requests.md) in AI-assisted development

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/ci-agents-trusted-triggers">Agent Wranglers AI-assisted development playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Treat what the agent reads as untrusted](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/untrusted-context.md)
- Next: [Know what the agent tool does with your code](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/tool-data-terms.md)
- [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)