---
title: "Protect the accounts that can change the · Agent Wranglers"
url: https://agentwranglers.se/playbook/engineering/version-control-and-review/code-host-accounts
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Protect the accounts that can change the code

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Version control and review](https://agentwranglers.se/playbook/engineering/version-control-and-review.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- Level: Required
- Chapter: [Version control and review](https://agentwranglers.se/playbook/engineering/version-control-and-review)
- Rule: Require two-factor login for everyone with write access to the code host. Remove a person's access when they leave, on the same day as their other keys.
- Risk: An account or system taken over
- How: Require two-factor login in the organisation settings, and allow only secure methods, such as passkeys, security keys or authenticator apps. Choose them as [two-factor login](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/two-factor-login) describes. Give each person their own account, with write access only to the repositories they work on. Give bots their own app or token with the fewest rights. Remove leavers by the deadline in [Remove access within a day of leaving](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/offboarding-within-a-day).
- Check: The organisation's member list, filtered for missing or insecure two-factor login, is empty. Every member and outside collaborator matches a name on the current staff or contractor list.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```sh
# GitHub: members without two-factor login, or with only SMS (needs an owner token)
for filter in 2fa_disabled 2fa_insecure; do
  gh api "orgs/example/members?filter=$filter" --jq '.[].login'
done | grep . && { echo "FAIL: members without secure two-factor login"; exit 1; } || echo "PASS"
```

## Sources

- [GitHub: Requiring two-factor authentication in your organization](https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization)

## Related rules

- [Offer two-factor login](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/two-factor-login) in Security testing
- [Remove access within a day of leaving](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/offboarding-within-a-day) in Compliance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/engineering/version-control-and-review/code-host-accounts">Agent Wranglers engineering playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Require an owner's review for sensitive code](https://agentwranglers.se/playbook/engineering/version-control-and-review/code-owners)
- [Version control and review](https://agentwranglers.se/playbook/engineering/version-control-and-review)