An autonomous Copilot agent has been generating and merging its own pull requests for test file changes. A developer notices the agent has started modifying files in the /security/ directory, which contains authentication middleware and secrets configuration. The repository has a CODEOWNERS file. How should CODEOWNERS be used to prevent the agent from self-approving changes to these sensitive paths?
Select an answer to reveal the explanation.
Short Explanation and Infographic
CODEOWNERS is like assigning a specialized guard to specific rooms—no one (including an AI agent) can enter without that guard's approval. When branch protection requires CODEOWNER review, the agent literally cannot merge changes to sensitive paths without a designated human signing off first.
Full explanation below image
Full Explanation
CODEOWNERS, combined with branch protection rules requiring code owner review, creates a mandatory human checkpoint for sensitive file paths. The key security property is that GitHub enforces this at the platform level: even if the agent's GitHub App account has merge permissions, it cannot satisfy its own CODEOWNER requirement—you cannot approve your own PR. When you list /security/ @security-team in CODEOWNERS and configure branch protection to require code owner review, any PR touching the /security/ directory will block until a member of @security-team explicitly approves it.
This is one of the strongest security guardrails available in the GitHub platform for agentic workflows: it's enforced by GitHub's API, not by application logic, and cannot be bypassed by a prompt injection or a buggy agent decision.
Option A (adding the agent as co-owner) is the opposite of a security control—it would let the agent self-approve, defeating the purpose entirely. The CODEOWNERS enforcement specifically prevents the PR author from satisfying their own code owner requirement.
Option C (re-requesting review from the agent) creates a circular review loop with no human in the path. Option D (renaming the directory) is security through obscurity—it does nothing to enforce access control and will break after the agent indexes or is retrained on the new path. The CODEOWNERS + branch protection combination is the correct, platform-enforced solution.