AI-Assisted Secure Coding (Appendix C) · Autonomous Agent Change Control Constraints
Agents can't bypass branch protection
Verify that autonomous agents cannot bypass branch protection, required reviews, required status checks, signed-commit requirements, or merge queues. Any attempt by an agent to change these settings raises a security alert.
OWASP AISVS v1.01, requirement AC.8.3
In plain English
Agents must not be able to get round branch protection, required reviews, required status checks, signed-commit rules or merge queues. If an agent tries to change any of those settings, that should raise a security alert.
What good looks like
- Agent identities have no bypass rights on any protected branch.
- Agent identities cannot edit repository or organisation protection settings.
- An attempt to change these settings by an agent identity triggers a security alert.
- The rules apply to administrators too, so an agent holding an admin token gains nothing.
How teams usually do it
- Repository rulesets with an empty bypass list for bots, and "do not allow bypassing" switched on.
- Audit-log streaming to your SIEM, with alerts on protection changes and on any such event by a bot identity.
- Periodic export and comparison of protection settings.
Suggested evidence
- Rulesets and bypass lists.
- Alert rules and a test alert.
Common mistakes
- Bot accounts added to the bypass list for convenience.
- Agents with repository admin permission.
- Protection on the default branch only, while release branches are open.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.