Landon Cox

GitHub Agentic Workflows is like a team of street sweepers that clean up messes in your repo. These teams significantly improve repo hygiene and quality, but CI jobs like Agentic Workflows largely run out of sight and out of mind. How do you put guardrails on agents that have access to your repository and the internet? Will you be wondering if your agents read documentation from a sketchy website or pushed a commit containing an API token? What if they decide to add spammy comments to every open issue?

Our approach to security in Agentic Workflows is guided by three design principles: (1) isolate agents from secrets, (2) control agent inputs based on repo-maintainer endorsements, and (3) stage and vet all repo updates. This talk will discuss how we apply those principles and the biggest challenges we see on the horizon.