Flowchart · 14 of 19 · Agent PR guardrails

An agent PR goes through the same gates, plus two that are about agents

Agents get no shortcut. Their PRs hit the same required checks as anyone's, and two new gates catch the failure modes that only agents have: editing their own controls, and acting under an identity that does not match the audit record.

An agent PR goes through the same gates, plus two that are about agents Flowchart of an agent-opened pull request passing the existing release guardrails and two new gates, agent-scope and agent-identity, in parallel; any failure returns a structured rule id and fix hint for up to three retries, while a pass routes to auto-merge for lower environments or human review for upper ones. ANY REDRETRY ≤ 3ALL GREENLOWERUPPERAgent PR openedExisting guardrailsprovenance (real) · registryagent-scopepaths within allowlistagent-identitysigner + task id vs auditChecks green?Structured failurerule id · path · fix hintTarget env?Auto-mergelower env · then ArgoCD pullsHuman reviewupper · CODEOWNERS · then pullLEGENDNew gateExists todayStartRetry / fail

Principle honored

Governance stubs are structurally loud, never a silent pass (ADR-0003). One file adds a gate to the releaseGuardrails registry.

What changes

  • agent-scope: changed paths must sit inside the profile allowlist, and never touch .tekton/, cicd.yaml guardrails, CODEOWNERS or AppProject files. An agent cannot edit its own gates.
  • agent-identity: the commit signer is an allowlisted workload identity, and the task id trailer exists in Clearance's audit log.
  • Both start as loud stubs and graduate to real, one at a time.

Verify live

For each new gate, open a PR that should fail it (edits .tekton/, or carries a forged task id) and confirm the required check goes red and blocks merge. Branch protection is a manual GitHub setting, so check it is actually required.

Hangar · Autopilot