Agent tokens cannot decide approval gates unless the repository allows it issue #258 closed: completed andymccall opened this · 0 comments
andymccall set labels security, feature ·
closed by change 4a68f1064b08 ·
andymccall set labels security, feature ·
closed by change 4a68f1064b08 ·
Decided by Andy (2026-10-18), following issue #229: by default an agent's token (an agent-marked token or a keyless agent's grant token) cannot approve or reject an approval gate; a person must. A repository setting (Settings, maintain role) allows agents to decide its gates. Decisions through agents keep recording 'via' (issue #229). The refusal says why and names the setting.