Agent Wranglers

AID-64Recommended

Let background agents deliver only pull requests

An agent that runs without a person watching works under its own bot identity and pushes only to its own branch prefix, such as agent/. It delivers a pull request and never approves, merges or deploys.

By Agent Wranglers. Updated .

How to do it

GitHub's own cloud agent shows the pattern. It pushes only to copilot/ branches and cannot approve or merge its own pull requests. The person who asked for the change cannot approve it either, and CI waits until someone with write access approves the run. Build the same limits for your own background agents. Give each one an app or bot account with short-lived tokens, so its commits are marked and its access can be revoked in one step. Restrict it with a branch rule and keep it off every bypass list. The approval rule is Have someone other than the requester approve agent changes. Who may start a run is in Run agents in CI only for trusted people.

Examples

Shell example

# Run with the agent's token. Each command must fail.
gh api -X PUT repos/example/shop/contents/README.md -f message=test -f content=dGVzdA== -f branch=main && echo "FAIL: pushed to main"
gh pr review 123 --approve && echo "FAIL: bot approved"
gh pr merge 123 --squash && echo "FAIL: bot merged"

How to check

With the agent's token, a push to main is rejected, an approving review is rejected and a merge is rejected. A push to agent/test succeeds. The bot account appears on no bypass list in the branch rules.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/ai-assisted-development/running-agents-at-scale/background-agents-open-pull-requests">Agent Wranglers AI-assisted development playbook</a>. In code you write, add a comment next to it with the same link.