Helpful first: CI/CD trust boundaries: writing code vs promoting to production · Excessive agency: why a model sentence is never an authorization decision
Key points
- Position AI coding agents on the authoring side of the SDLC trust boundary rather than the approval or promotion side
- Defend autonomous repo agents against indirect prompt injection via issues, pull requests, and build logs
- Enforce deterministic compiler, SAST, SCA, and human review gates before any agent-authored diff merges
Speeding up authoring without collapsing the review gate
At Meridian Space & Robotics (chronos.orbital), Propulsion Lead Priya Nair uses an autonomous coding agent (dev-bot-02) to draft boilerplate telemetry parsers, propose dependency bumps, and triage failing unit tests. An agent can generate a 400-line pull request in thirty seconds - complete with a polite, confident summary explaining why the change is safe.
Principal Security Architect Vera Vance reminds the engineering org of a foundational rule: fluency is not provenance, and speed does not change trust boundaries. Whether a commit was typed by a human contractor, generated by an IDE autocomplete model, or opened by an autonomous background agent, that diff is an untrusted proposal until deterministic static/dynamic checks and an accountable human reviewer verify it.
| SDLC Action | May the Coding Agent Do This Autonomously? | Primary Risk If Unchecked | Mandatory Engineering Control |
|---|---|---|---|
| Draft code & open PR on feature branch | Yes (within scoped sandbox) | Hallucinated packages (slopsquatting) or insecure crypto/SQL idioms | Deterministic SAST, lockfile registry verification, and secret scanning on every PR |
| Read untrusted GitHub issues / external PR comments | Only with strict tool isolation | Indirect prompt injection tricks agent into editing .github/workflows or leaking runner tokens | Block agent write access to CI workflow files; run agent in ephemeral secretless workspace |
| Approve a pull request or satisfy branch-protection review count | Never | Self-approval loop bypasses separation of duties | Branch protection requires cryptographic sign-off from a distinct human code owner (CODEOWNERS) |
| Trigger production deployment or sign SLSA release provenance | Never | Unverified code promoted directly to orbital control plane | Release signing and promotion bound strictly to post-merge pipeline after human review |
Interactive trace: who writes vs who ships
Walk through the interactive pipeline trace below to see how one change moves from authoring to runtime. Notice how the coding agent operates strictly inside the Author / Propose lane: it can read repository context and propose a commit on a feature branch, but it cannot mark its own pull request approved, modify the branch-protection policy, or mint the production deployment attestation.
Pay particular attention to what happens when an attacker plants an indirect prompt injection inside a bug report or third-party dependency README (for example, instructing the agent to add a new postinstall hook or weaken an authorization check). Because the agent’s output is forced through deterministic linters, lockfile policy checks, and mandatory CODEOWNERS human review before reaching the protected main branch, the poisoned proposal is caught at the gate.
Slopsquatting and workflow file locks
Two supply-chain hazards are uniquely amplified by coding agents. First, slopsquatting: Large Language Models occasionally hallucinate plausible-sounding package names (like chronos-math-utils or fastapi-jwt-helper). Attackers systematically discover which package names LLMs hallucinate and register them on public registries with malicious payloads. Meridian’s CI pipeline blocks any new dependency not already vetted in the internal artifact proxy.
Second, workflow file modification: if an autonomous agent is allowed to edit .github/workflows/*, Dockerfile, or CODEOWNERS, a single prompt injection can rewrite the very CI gates meant to inspect the agent’s code. Always deny coding agents write permission to pipeline definitions and security policy files.
So the control is not only who clicks deploy: the control is who can modify a workflow that reads deployment credentials from its execution environment.
CHECK YOUR JUDGMENT
To speed up hotfixes at Meridian Space & Robotics (chronos.orbital), an engineering manager proposes letting the repository’s AI coding agent (dev-bot-02) automatically open a pull request, run a second "AI reviewer agent" to approve the PR, and auto-merge directly to main whenever both agents agree. How should Principal Security Architect Vera Vance respond?
CHECK YOUR JUDGMENT