Ask where AI-assisted work enters delivery and what it can reach: PRs, workflow files, CI secrets, package scripts, MCP tools, cloud commands, release workflows, and evidence trails.
If you can only answer five questions first
Start with the questions that reveal write, credential, publish, deploy, and production access.
- Can agents edit workflow files?
- Can CI triggered by agent-authored PRs access secrets?
- Where does approval happen before credential use?
- Which credentials are inherited, standing, delegated, or scoped?
- Can you reconstruct owner, workflow, credential, action, target, approval, and outcome afterward?
The 12 questions
Can agents edit workflow files?
Look at `.github/workflows/*`, GitLab CI, Buildkite, CircleCI, Harness, release config, and IaC-adjacent automation.
Can CI triggered by agent-authored PRs access secrets?
Map which secrets, tokens, package credentials, cloud keys, or deploy credentials are reachable by the workflow.
Can package changes execute scripts in CI?
Package managers can turn dependency changes into command execution inside build or release automation.
Are MCP tools connected to internal systems?
List GitHub, Jira, Slack, cloud, data, incident, customer, and internal APIs reachable through agent tools.
Where does approval happen?
Separate PR review from approval before credential use, tool calls, deploy triggers, or cloud-adjacent actions.
Which credentials are inherited, standing, delegated, or scoped?
Distinguish local developer access, PATs, CI secrets, app tokens, service accounts, and short-lived credentials.
Can you reconstruct the path afterward?
Human owner, agent/session, repo, branch, PR, workflow, credential, approval, action, target, and outcome should be provable.
Who owns the full path?
Engineering, platform, DevEx, IAM/PAM, release engineering, AI platform, and security reviewers may each own only part of it.
Which actions stay allowed?
Normal code edits, tests, docs, and local refactors should stay fast when they cannot use credentials, publish, deploy, or affect production.
Which actions need approval?
Package installs, workflow edits, internal tool calls, deploy triggers, cloud commands, and secret-adjacent reads are common candidates.
Which actions should be blocked?
Disabling checks, unmanaged secret reads, broad PAT use, destructive production actions, or workflow changes that bypass approval.
What changes from pilot to scale?
Individual AI coding usage becomes a control problem when it standardizes across repos, CI/CD, MCP tools, service tokens, or releases.
Turn the questions into a graph.
Use the lab to simulate a path and generate an Agent Action BOM your team can discuss.
Open the lab