Security boundaries
Agent work can read repositories, run shells and use configured accounts. Check the host, credentials and repository permissions before starting a task.
Task scope describes the intended work. Runtime controls and permissions determine actual access. Automated review supplies findings; it does not replace those controls.
Inspect the execution environment
The Studio coordinates configured CLIs, Git and repositories. You operate the hosts and accounts. Check which repository a runner can change and what its CLI may send to a model provider. Self-hosting the Studio does not make model calls offline.
Exception example: the task is escalated and integration is pending. The visible task and Git state does not by itself demonstrate operating-system isolation or access permissions.
Match review effort to the change
Changes to credentials, dependencies, permissions or external integrations need focused review. Record the relevant checks, findings and remaining uncertainty. A larger token budget or stronger model is not evidence that a result is secure.
Define and enforce the permitted scope
Name the target repository, affected files and expected result. Configure permissions accordingly. Split work across repositories into explicit tasks and keep reference checkouts and production secrets outside the intended write scope.
Treat integrations as permission boundaries
For any ticket-system integration, define which projects and records it may read or update. Retain the request, resulting action and review. Jira, Azure DevOps, GitHub Issues, GitLab and Linear are examples of systems to evaluate, not a list of shipped Studio connectors.