---
title: "Keep publishing rights away from agents · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/no-publish-rights-for-agents
id: AID-72
level: Required
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 986
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Keep publishing rights away from agents

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AID-72
- Level: Required
- Chapter: [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)
- Rule: Agents cannot publish packages, push release tags, sign builds or deploy. Only the release pipeline can, with short-lived credentials and after a person approves the run.
- Check: From an agent session, publish a test package, push a tag that matches the release pattern and read the signing key path. All three fail. The package settings show token publishing turned off.
- Risk: An account or system taken over
- How: An agent with a registry token publishes a package as easily as it runs the tests. In 2026 an evaluation agent published a malicious package to a public registry, and a scanner that installed it leaked credentials. A worm the same year spread through stolen publishing tokens. Remove registry tokens, signing keys and deploy keys from every place an agent runs. Publish from the pipeline through trusted publishing, which replaces stored tokens with short-lived ones tied to the workflow. Then turn off token publishing. Protect release tags and the release workflow, so an agent's branch cannot start them, as [Run agents in CI only for trusted people](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/ci-agents-trusted-triggers.md) says. Token scope in general follows [Give agents the fewest rights they need](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/least-privilege-agents.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### YAML example

```yaml
on:
  push:
    tags: ['v*']
jobs:
  publish:
    runs-on: ubuntu-latest
    environment: release
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@<full-commit-hash>
      - run: npm ci && npm publish
```

## Sources

- [npm Docs, trusted publishing](https://docs.npmjs.com/trusted-publishers)
- [OWASP GenAI and agentic AI exploit round-up, Q3 2026](https://genai.owasp.org/2026/10/08/genai-and-agentic-ai-exploit-roundup-q3-2026/)

## Related rules

- AID-29 [Run agents in CI only for trusted people](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/ci-agents-trusted-triggers.md) in AI-assisted development
- AID-26 [Give agents the fewest rights they need](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/least-privilege-agents.md) in AI-assisted development

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/no-publish-rights-for-agents">Agent Wranglers AI-assisted development playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Give browser agents their own profile and test accounts](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/separate-agent-browser.md)
- Next: [Approve destructive commands](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/approve-destructive-commands.md)
- [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)