AI-Assisted Secure Coding (Appendix C) · Autonomous Agent Change Control Constraints
Agents can't approve their own work
Verify that autonomous agents cannot approve, merge, sign, or deploy artifacts that they themselves generated, and that this constraint is enforced by the source-control system, the CI system, and the artifact registry. Policy alone does not satisfy this control.
OWASP AISVS v1.01, requirement AC.8.1
In plain English
An autonomous agent must not be able to approve, merge, sign or deploy anything it generated. The source-control system, the CI system and the artifact registry each have to enforce that. A written policy does not satisfy this control, because an agent following injected instructions will not consult it.
What good looks like
- The agent's identity cannot approve or merge its own pull requests.
- It cannot sign artifacts built from its own changes or deploy them.
- The restriction is enforced in source control, in CI and in the artifact registry.
- A test confirms each of the four actions is refused.
How teams usually do it
- A dedicated bot identity whose permissions allow opening PRs and exclude approving, merging, signing and deploying.
- Branch protection that requires approval from someone other than the author and does not count bot approvals.
- Signing and deployment credentials held by pipeline stages the agent cannot trigger or modify.
Suggested evidence
- The agent identity's permissions in each of the three systems.
- Test results showing each action refused.
Common mistakes
- An agent account with admin rights so it can "fix its own PRs".
- Two agent identities that approve each other's work.
- Enforcing this in source control while the agent's token can still push to the artifact registry.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.