32VERTICAL CONTROLS

Coding Agent Security

Agent Trust Cloud protects the authority around coding agents; it does not compete with the code-generation model.

Priority: P1
Phase: Phase 2
Primary owner: DevSecOps / Product
Status: Blueprint

Objective

Coding agents can read proprietary code, modify repositories, install dependencies, access CI/CD secrets and trigger deployments. Secure them as privileged engineering identities rather than treating them like autocomplete tools.

What to build

Repository/file scope restrictions.
Branch and environment controls for writes.
Dependency/package installation policy.
Secret scanning on prompts, diffs and logs.
Approval for merges, production deployment or infrastructure changes.
Command/tool execution policies in development sandboxes.

Implementation decisions

Integrate GitHub/GitLab identities, repository permissions and CI/CD events.
Associate each code change with agent identity, initiating human and task.
Require protected branch policies independent of agent suggestion.
Detect attempts to modify security controls, workflow permissions or secret paths.

Definition of done

Agent-generated changes preserve attribution.
Production deploys require configured human/release gates.
Sensitive repository operations are governed at command/action level.

Success metrics

Agent commits/PRs
Protected operations blocked
Secrets prevented
Agent-caused rollback rate

POSITIONING

Agent Trust Cloud protects the authority around coding agents; it does not compete with the code-generation model.

This control is specified on page 32 of the blueprint.