The identity that builds the code must not be the identity that ships it.
One change from a coding agent also edits the publish workflow. If the builder also holds the publish key, the edited workflow runs with the publish secret, and no second look happens. If a different identity holds the key, the change waits for a code owner. That identity can be a person, a policy, or another agent. Green CI and model LGTM are build signals. They are not the ship decision.
Build · the builder is the coding agent
CI · Build signals
Promote · Holds the publish key
Runtime · Production
Step 1 of 5