Approvals made with an agent token should say so (and may need to be refused) issue #229 closed: completed andymccall opened this · 2 comments
andymccall set labels security ·
andymccall
Superseded in its approach by issue #235 (sealed approvals): an approval becomes a statement signed by the approver's own key; delegated keys refused by default.
andymccall
Partly settled by issue #235: a gate that takes a sealed approval (the default for a job with an environment) refuses delegated agent keys, so an agent cannot release a deploy. Still open: an unsealed approval through an agent token is recorded as the person with no via.
closed by change 05f1a85a2842 ·
andymccall referenced by change 4a68f1064b08 on main ·
Found while proving oxygenflow#57 (2026-10-16): approving a gated job with an agent token (Claude Code delegated by andymccall) records it as "approved by andymccall", in the run, the job log and the audit log, with no trace of the agent. Pushes and comments already record the agent they came through (via). For approval gates this matters more: a gate exists so a person decides. Proposal: record via on approvals and show it; and add a repository or site setting so agent tokens cannot approve gates at all (default: refuse?), since an agent approving the deploy its own push started defeats others-only. Needs Andy's call on the default.