---
title: "Require an owner's review for sensitive · Agent Wranglers"
url: https://agentwranglers.se/playbook/engineering/version-control-and-review/code-owners
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Require an owner's review for sensitive code

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Version control and review](https://agentwranglers.se/playbook/engineering/version-control-and-review.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- Level: Recommended
- Chapter: [Version control and review](https://agentwranglers.se/playbook/engineering/version-control-and-review)
- Rule: Name the owners of payment, login, permission, deploy and CI files. Require one of them to approve every change to those files.
- How: List paths and owners in a code owners file, such as `CODEOWNERS` on GitHub or GitLab. Turn on required review from code owners in the branch protection of [Protect the main branch](https://agentwranglers.se/playbook/engineering/version-control-and-review/protect-the-main-branch). Give the code owners file and the CI folder an owner too, so nobody can remove the guard in the same change. Name teams rather than single people, so one person's holiday does not block merges.
- Check: Open a pull request that changes a payment file, approved only by someone outside its owners. It cannot merge. The code host reports no errors in the code owners file, such as an empty list from `gh api repos/example/shop/codeowners/errors`.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Plain text example

```text
# .github/CODEOWNERS: the last matching line wins
*                   @example/developers
/src/payments/      @example/payments
/src/auth/          @example/security
/.github/           @example/platform
/deploy/            @example/platform
```

### Shell example

```sh
# Fail when the code owners file has errors that would leave paths without owners
errors=$(gh api repos/example/shop/codeowners/errors --jq '.errors | length')
[ "$errors" -eq 0 ] || { echo "FAIL: $errors errors in CODEOWNERS"; exit 1; }
```

## Sources

- [GitHub: About code owners](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners)

## Related rules

- [Protect the main branch](https://agentwranglers.se/playbook/engineering/version-control-and-review/protect-the-main-branch) in Engineering

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/engineering/version-control-and-review/code-owners">Agent Wranglers engineering playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Update dependencies in small automatic steps](https://agentwranglers.se/playbook/engineering/version-control-and-review/automated-dependency-updates)
- Next: [Protect the accounts that can change the code](https://agentwranglers.se/playbook/engineering/version-control-and-review/code-host-accounts)
- [Version control and review](https://agentwranglers.se/playbook/engineering/version-control-and-review)