For AI agents: llms.txt is a short guide that sends you to the rules your problem needs, and rules.json holds every rule of this playbook as JSON.

Risk if broken

An account or system taken over

How to do it

The person who wrote the prompt shaped the change, so treat them as a co-author. Give the agent a token that can push branches but not approve or merge. Record the requester in each agent commit with a trailer, such as Requested-by: ana, next to the agent trailer. A required check then fails until someone else has approved. GitHub's cloud agent blocks the requester's approval on its own pull requests, for example. Do not run CI jobs that hold secrets on an agent branch before a person has read it, because the agent can edit workflow files. Scope those secrets as Keep secrets out of builds from strangers says. This adds one rule to Protect the main branch.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

Shell example

# Required check: someone other than the requester approved the pull request
requester=$(git log -1 --format='%(trailers:key=Requested-by,valueonly)' "$HEAD_SHA" | head -n 1)
approvers=$(gh api "repos/$REPO/pulls/$PR_NUMBER/reviews" --jq '.[] | select(.state == "APPROVED") | .user.login' | sort -u)
echo "$approvers" | grep -vxF "${requester:-none}" | grep -q . || { echo "Needs approval from someone other than $requester"; exit 1; }

YAML example

on:
  pull_request_review:
    types: [submitted, dismissed]
permissions:
  contents: read
  pull-requests: read
jobs:
  independent-approval:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@<full-commit-hash>
        with: { ref: "${{ github.event.pull_request.head.sha }}" }
      - run: ./scripts/independent-approval.sh
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}

How to check

Open a test pull request from the agent's token with a Requested-by trailer. The agent's own approval fails, the requester's approval alone does not unlock the merge, and one approval from another reviewer does.

Sources

• GitHub Docs, risks and mitigations for Copilot cloud agent

Related rules

• Keep secrets out of builds from strangers in Security testing
• Protect the main branch in Engineering