Allowed
Clone and update selected repositories
Push matching agent/* branches
Open and update pull requests
Run tests and deploy to staging
Example authority for a coding task
Pull requests are usually normal output, not the risky moment. Scope GitHub by repository and branch pattern, then use a separate deploy, production-data, or internal API grant when the task may affect a live system.
Allowed
Clone and update selected repositories
Push matching agent/* branches
Open and update pull requests
Run tests and deploy to staging
Ask first
Deploy this reviewed commit to production
Read sensitive production data
Run a destructive maintenance action
Not granted
Push directly to protected branches
Merge pull requests
Use other repositories or environments
Retrieve underlying provider credentials
The exact production actions depend on the deploy or internal tool the customer connects. Without that separate grant, the coding agent cannot cross the boundary.
From task to review
Use a configured VM, container, or local machine to inspect and test the code. Let the agent push matching review branches and open pull requests without interruption. Keep protected branches, production access, deploys, and destructive actions behind separate grants.
Selected repositories
A task can use one repository or several without handing the agent a user-level token for everything the human can access.
Review output
Allow matching review branches and pull requests as normal output. Keep merge authority separate rather than asking for approval on every PR.
Repeat later
After the manual path works, schedules, events, and workflows can reuse the same repository and action grants.
Where teams start
Related engineering paths
Select repositories and branch patterns while keeping pull request and merge actions separate.
Read moreConnect a local MCP client while keeping its machine access separate from tools supplied through ExecWarden.
Read moreTurn a useful maintenance or coding task into a workflow started manually, on a schedule, or from an event.
Read moreStart a coding task
The fastest first test is a coding task that ends in a branch, test output, and a PR someone can inspect.