Answers · agent safety
How do I make an AI coding agent's commits go through pull requests instead of straight to main?
Last updated
TL;DR: Give the agent its own GitHub identity with write access, not admin, and protect the default branch so that identity can't push to it directly. On GitHub, a ruleset or branch protection rule that requires a pull request before merging, with at least one approval, does that. Add an approval of the most recent reviewable push by someone other than the person who pushed it, so an agent can't add commits after a human approved. Keep required status checks passing, and leave force pushes and deletions blocked (the defaults). The setting people miss: by default branch protection rules don't apply to repository admins, so an agent running with your admin token skips them unless you turn on Do not allow bypassing the above settings. In rulesets, only actors on the bypass list can bypass, so keep agents off it. GitHub's own Copilot cloud agent shows the target pattern: it pushes only to its own copilot/ branch, can't approve or merge its pull requests, and the person who asked for the change can't approve it either.
What should I check, step by step?
1. Create a separate identity for the agent (a machine account or a GitHub App) with write access to the repository, never admin. Pair it with the commit author setup in the related git-identity answer.
- Protect the default branch: in a ruleset, turn on Require a pull request before merging with at least 1 required approval (or the same in a classic branch protection rule).
- Turn on Require approval of the most recent reviewable push, and Dismiss stale pull request approvals when new commits are pushed, so an approval covers what actually merges.
- Require status checks to pass, and for checks that matter, pin the expected source to the GitHub App that runs them. GitHub's docs note that any person or integration with write access can set a commit status, which includes the agent.
- Classic branch protection: turn on Do not allow bypassing the above settings so admins (and an agent using an admin's token) are held to the rule. Rulesets: keep the agent's account or app off the bypass list.
- Keep Block force pushes and Restrict deletions on. Both are on by default and stop an agent from rewriting or deleting the protected branch.
- Add CODEOWNERS with Require review from Code Owners for paths such as .github/workflows, deployment config and auth code, so agent changes there need the owning team.
- Test it: as the agent's identity, try git push to main and confirm GitHub rejects it with a protected-branch error, then open a pull request and confirm it can't be merged without the approval.
- Check your plan: protected branches work in public repositories on GitHub Free, and in private repositories on GitHub Pro, Team and Enterprise. Bypass lists are only available in repositories owned by an organization.
How GitHub's Copilot cloud agent is fenced
GitHub's risks-and-mitigations page says the agent can push only to a single branch (a new copilot/ branch, or the pull request's branch when mentioned on one), can't run git push itself, is subject to branch protections and required checks, can't mark its pull requests ready for review or approve or merge them, and doesn't trigger GitHub Actions workflows until someone with write access approves the run.
- The developer who asked the agent to create a pull request can't approve it, and when the agent opens a pull request under its own app identity rather than on behalf of a person, rulesets require one more approval than configured (public preview, on by default, only when at least one approval is already required).
- A ruleset or branch protection rule can block Copilot from creating or updating pull requests; administrators can add a bypass for Copilot. Scope that bypass to what it needs, since a bypass also lifts the review gate.
Rulesets vs classic branch protection
Rulesets layer: if several rulesets and branch protection rules target the same branch, all of them apply and the most restrictive version of each rule wins. Only one classic branch protection rule applies to a branch at a time.
- Restrict updates in a ruleset limits pushes to matching branches to actors with bypass permission. Restrict who can push to matching branches does the same in classic protection for organization repositories, but people and apps with admin permissions can always push there.
- With Require signed commits on, contributors and bots can only push signed and verified commits to the branch, so if you turn it on, give the agent's identity a signing key.
How do I ask Rightshold about this (free, no key)?
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “Before I approve this agent-written pull request, scan its description and the instructions file it changed for hidden text or instructions aimed at the reviewer or the next agent.”
{
"tool": "scan_text",
"arguments": {
"text": "<the pull request description, or the changed AGENTS.md / CLAUDE.md / instructions file>"
}
}- Free, no key. It reports exact positions of zero-width and bidirectional characters, hidden markup and base64 blobs, and labels instruction-like language as a heuristic, never a certainty.
- record_ai_run (with an API key) records a signed summary of the agent run behind a pull request (model, provider, prompt and output by hash) that a reviewer can check later with verify_ai_run.
- check_license with a dependency's repository URL as source_url tells you the license of a package the agent added.
Rightshold does not configure GitHub, review pull requests or hold repository permissions. It scans text you give it and records signed run summaries you send. Not legal advice.
What are the sources?
- GitHub Docs: About protected branches (required reviews, most recent push, Do not allow bypassing, status check sources, plans)
- GitHub Docs: Available rules for rulesets (require a pull request, additional approval for unattributed Copilot pull requests)
- GitHub Docs: About rulesets (bypass lists, rule layering)
- GitHub Docs: Risks and mitigations for GitHub Copilot cloud agent
- GitHub Docs: Copilot on GitHub (repository rules can block Copilot; ruleset bypass)
Related
- How to give an AI coding agent its own git identity for commits
- How to stop an AI coding agent from deleting your production database
- How to give an MCP server least-privilege access to GitHub
- How to log every AI agent tool call for audit
Not legal advice. JSON · Markdown · All answers
Get a free API key in one call
No card and no email needed. 100 free credits; the license and policy checks stay free without a key.
curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_... # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
-H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'