A pull request asks an agent to explain a failing test. The agent reads changed files, dependency output, and the pull-request description. The job also happens to hold a repository write token.
That is an identity decision disguised as a CI convenience.
The Claude Code Action advisory and Gemini CLI workflow advisory illustrate execution risks in agent-enabled automation. Their mechanisms differ, so inspect the relevant advisory rather than assuming all agent actions fail in the same way.
Start with the work that needs no authority
An agent explaining a test failure generally needs source files and bounded test output. It does not need package publication rights, cloud deployment access, or authority to approve a pull request.
Run that analysis in an isolated job with read-only access and no sensitive credentials. Treat pull-request text, repository files, dependency metadata, and tool output as untrusted inputs.
The output is a proposal. It should carry no authority simply because an agent produced it.
Make the handoff explicit
| Analysis job produces | Privileged job must verify |
|---|---|
| Suggested patch | Exact diff, allowed paths, and approved base revision |
| Dependency change | Resolved package, version, and provenance |
| Proposed command | A permitted operation expressed as structured arguments |
| Publication request | Protected event, approved artifact, and release policy |
Do not let the privileged job execute a command string from the analysis artifact. That would reintroduce the same trust boundary through a different file.
Use a human gate or deterministic policy appropriate to the action. Bind the decision to the exact revision and artifact being changed so an approval cannot quietly apply to different input.
Issue credentials when action is justified
Once the required conditions pass, give the mutation job a short-lived token scoped to the specific operation. Keep package publishing, repository writes, and cloud changes as separate grants.
Review the checkout configuration as well. Credentials persisted into repository state or inherited by child processes can survive assumptions made at the workflow level.
Verify the split
Trigger the workflow with a test pull request containing instructions to write an unrelated file or contact a controlled endpoint. The analysis job should lack the authority to perform privileged actions, regardless of how the model interprets the text.
Inspect the resulting proposal and the approval decision. A rejected proposal should remain inert. This provides evidence about the workflow's permissions as well as the model's behavior.