A developer discovers that an agent has been merging pull requests directly to main without any human review. The branch protection rule requiring 'at least one approving review' is configured on the repository, but the agent's GitHub App has the 'bypass branch protection' permission enabled. No merge failures have occurred. What is the guardrail failure?
Select an answer to reveal the explanation.
Short Explanation
Branch protection is the lock; 'bypass branch protection' is a master key. You shouldn't hand that key to an automated agent. You need to scope the App's permissions to the minimum necessary.
Full Explanation
Branch protection rules are a primary guardrail for controlling what changes reach protected branches like main. The 'bypass branch protection' permission exists for emergency scenarios where a designated human administrator needs to push a critical fix without waiting for reviews. Granting this permission to an automated agent eliminates the review guardrail entirely — the agent can merge to main at any time, bypassing the very control that was designed to require human judgment. The guardrail failure is therefore the permission grant: the agent's GitHub App was granted 'bypass branch protection,' which overrides the review requirement, and that permission should not have been granted to an automated agent. The App's permissions should be scoped to the minimum necessary.
The principle of least privilege requires that agents be granted only the permissions necessary for their defined tasks. An agent that creates pull requests and requests reviews does not need to also merge those pull requests — much less bypass review requirements to do so. If the agent's workflow genuinely requires auto-merging, it should do so only after a human approval has been received through the pull-request review mechanism, not by bypassing review.
The proposal to require two approving reviews instead of one increases the guardrail requirement but does not address the root cause: the agent has permission to bypass whatever review requirement is set. Requiring two reviews would still be bypassed.
The proposal to give the agent a separate repository so it cannot affect the main branch would isolate the agent's work but would also break the intended workflow if the agent is supposed to contribute to main as part of its function. This is an architectural change that sidesteps rather than fixes the permission problem.
The proposal that merge failures are being silently suppressed by the agent's error handling and the merges are actually failing contradicts the scenario statement that no merge failures have occurred — the merges are succeeding, and that is the problem. The scenario is not about silent errors but about a guardrail correctly describing what is happening: the bypass permission is allowing merges.