An agent is authorized to create new GitHub repositories for project scaffolding. The security team is concerned the agent might create repositories with public visibility, potentially exposing proprietary code. Which control most reliably prevents the agent from creating public repositories, regardless of the parameters it generates?
Select an answer to reveal the explanation.
Short Explanation and Infographic
System prompts can be overridden by prompt injection, and a 'create then fix' pattern leaves a window of exposure. An org-level policy is a platform-enforced control that the agent literally cannot override regardless of what parameters it passes to the API — the policy wins. The correct answer is B.
Full explanation below image
Full Explanation
GitHub organization policies create platform-level constraints that override individual API calls and user/application permissions. Setting 'Default repository visibility' to 'Private' at the organization level means that even if the agent's API call to Create a Repository specifies 'visibility: public', the organization's policy overrides the request and the repository is created as private.
Additionally, disabling 'Repository visibility change' prevents the agent (or any other actor without appropriate permissions) from later changing a private repository to public. This provides two layers of protection: the creation default forces private, and the visibility-change policy prevents post-creation exposure.
This is the correct approach because it is a platform-enforced technical control that operates independently of the agent's behavior. The agent cannot override an organization policy through its API calls, prompt parameters, or any other mechanism.
Option A is incorrect because system prompts are not technical controls — they are instructions to the language model. A prompt injection attack or a sufficiently strong instruction in the task context can override the system prompt's instructions. 'Always create private repos' in the system prompt provides no guarantee if the model decides otherwise.
Option C is incorrect because the 'create then fix' pattern creates a window of exposure: between the creation step (public) and the visibility-change step (private), the repository exists as public. During this window, it could be discovered by search engines, bots, or other automated systems. Any code committed in that window is exposed.
Option D is incorrect because weekly review is a detective control, not a preventive control. A public repository created Monday morning remains public until the following week's review, a potentially catastrophic exposure window for proprietary code.