An autonomous Copilot agent has been generating and merging its own pull requests for test file changes. A developer notices the agent has started modifying files in the /security/ directory, which contains authentication middleware and secrets configuration. The repository has a CODEOWNERS file. How should CODEOWNERS be used to prevent the agent from self-approving changes to these sensitive paths?
Select an answer to reveal the explanation.
Short Explanation
CODEOWNERS is like assigning a specialized guard to specific rooms—no one, including an AI agent, can enter without that guard's approval. When branch protection requires code owner review, you block the agent from merging changes to sensitive paths until a designated human signs off.
Full Explanation
Assigning the /security/ path to a human security team in CODEOWNERS and enabling branch protection requiring their approval is correct because it creates a mandatory human checkpoint for sensitive file paths. The key security property is that GitHub enforces this at the platform level: even if the agent's GitHub App account has merge permissions, it cannot satisfy its own code owner requirement—you cannot approve your own pull request. When you list /security/ @security-team in CODEOWNERS and configure branch protection to require code owner review, any pull request touching the /security/ directory will block until a member of @security-team explicitly approves it. This is one of the strongest security guardrails available in the GitHub platform for agentic workflows: it is enforced by GitHub's API, not by application logic, and cannot be bypassed by a prompt injection or a buggy agent decision. The approach that adds the agent's GitHub App account as a co-owner of the /security/ directory so it reviews its own pull requests is the opposite of a security control—it would let the agent self-approve, defeating the purpose entirely, and CODEOWNERS enforcement specifically prevents the pull request author from satisfying their own code owner requirement. The workflow step that scans the agent's pull request for changes to /security/ and automatically re-requests review from the agent itself creates a circular review loop with no human in the path. Renaming the /security/ directory to an obscure name so the agent's path matching logic does not find it is security through obscurity—it does nothing to enforce access control and will break after the agent indexes or is retrained on the new path. The CODEOWNERS plus branch protection combination is the correct, platform-enforced solution.