G
Integration · Developer
Govern your GitHub agent.
Let agents open issues and PRs and read code — without merging to main, deleting repos, or leaking secrets.
The risk
What can go wrong when an agent holds GitHub.
A raw GitHub token lets an agent do anything the token can — no boundary, no record. These are the actions you don't want it taking on its own.
- Merging to protected branches
- Deleting repos or branches
- Reading or printing secrets / env files
- Force-pushing or rewriting history
The HiveKey policy
Scope it. Guard it. Log it.
Give the agent a role with exactly the GitHub actions it needs, then guard the rest in the path.
Scope — granted
- repo.read
- issues.write
- pr.create
Guard — enforced
- Deny merge to main (require review)
- Deny repo/branch delete
- Block reads of .env and secrets
The proof
Every GitHub action — allowed or denied — on one trail.
github-agent · action log live
pr_create feat/x scope: pr.create allow
merge → main guard: protected branch deny
Put your GitHub agent under one policy.
See HiveKey scope, guard, and log your GitHub agent and the rest of your fleet.