--- title: "Let background agents deliver only pull ยท Agent Wranglers" url: https://agentwranglers.se/playbook/ai-assisted-development/running-agents-at-scale/background-agents-open-pull-requests id: AID-64 level: Recommended updated: 2026-10-22 tokens: 968 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Let background agents deliver only pull requests For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Running agents at scale](https://agentwranglers.se/playbook/ai-assisted-development/running-agents-at-scale.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22. - ID: AID-64 - Level: Recommended - Chapter: [Running agents at scale](https://agentwranglers.se/playbook/ai-assisted-development/running-agents-at-scale.md) - Rule: An agent that runs without a person watching works under its own bot identity and pushes only to its own branch prefix, such as `agent/`. It delivers a pull request and never approves, merges or deploys. - Check: With the agent's token, a push to `main` is rejected, an approving review is rejected and a merge is rejected. A push to `agent/test` succeeds. The bot account appears on no bypass list in the branch rules. - How: GitHub's own cloud agent shows the pattern. It pushes only to `copilot/` branches and cannot approve or merge its own pull requests. The person who asked for the change cannot approve it either, and CI waits until someone with write access approves the run. Build the same limits for your own background agents. Give each one an app or bot account with short-lived tokens, so its commits are marked and its access can be revoked in one step. Restrict it with a branch rule and keep it off every bypass list. The approval rule is [Have someone other than the requester approve agent changes](https://agentwranglers.se/playbook/ai-assisted-development/reviewing-agent-output/independent-approval.md). Who may start a run is in [Run agents in CI only for trusted people](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/ci-agents-trusted-triggers.md). ## Examples **Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses. ### Shell example ```bash # Run with the agent's token. Each command must fail. gh api -X PUT repos/example/shop/contents/README.md -f message=test -f content=dGVzdA== -f branch=main && echo "FAIL: pushed to main" gh pr review 123 --approve && echo "FAIL: bot approved" gh pr merge 123 --squash && echo "FAIL: bot merged" ``` ## Sources - [GitHub Docs, risks and mitigations for Copilot cloud agent](https://docs.github.com/en/copilot/concepts/agents/cloud-agent/risks-and-mitigations) ## Related rules - AID-22 [Have someone other than the requester approve agent changes](https://agentwranglers.se/playbook/ai-assisted-development/reviewing-agent-output/independent-approval.md) in AI-assisted development - AID-29 [Run agents in CI only for trusted people](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/ci-agents-trusted-triggers.md) in AI-assisted development **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers AI-assisted development playbook`. In code you write, add a comment next to it with the same link. - Previous: [Give every parallel agent its own working copy](https://agentwranglers.se/playbook/ai-assisted-development/running-agents-at-scale/parallel-agent-workspaces.md) - Next: [Cap open agent pull requests at what people can review](https://agentwranglers.se/playbook/ai-assisted-development/running-agents-at-scale/agent-review-capacity.md) - [Running agents at scale](https://agentwranglers.se/playbook/ai-assisted-development/running-agents-at-scale.md)