Give a review bot the ability to read code and post comments, and nothing else. Coding agents that open pull requests need write access to a branch, not to your default branch, secrets or workflow files. Check the token each tool runs with, and revisit it when features change.
Why this matters more for AI
A traditional linter runs fixed logic. A model reads untrusted text and decides what to do. OWASP's guidance on prompt injection recommends enforcing least privilege, handling functions in code rather than in the model, and requiring human approval for high risk actions. If a bot is tricked, its permissions set the damage.
A permission checklist for a review bot
Needs:
- Read access to the repository contents it reviews.
- Permission to post review comments on pull requests.
Does not need:
- Permission to approve or merge, unless you have decided deliberately that it should.
- Access to repository or organization secrets.
- Write access to workflow files.
- Access to other repositories.
- Network access to arbitrary hosts.
A checklist for a coding agent
- Push only to a feature branch, never to the protected branch.
- Branch protection stays on, so required checks and human approval still apply.
- No ability to modify the files that define checks, such as workflows or CODEOWNERS, without a code owner review.
- Short lived credentials, scoped to one repository.
- A log of actions that a person can read.
Use the platform to enforce it
Branch protection helps here. GitHub's documentation says required status checks must pass and required reviews must be given before changes reach a protected branch. Owners can be required to review files they own, and you can assign an owner to the CODEOWNERS file itself to guard against unauthorized changes. These controls apply no matter who or what authored the commit.
Also note that some tools document their own limits. GitHub states that Copilot reviews do not count toward required approvals unless that option is enabled. Keep the default.
Audit the token
Once a quarter, list each bot account or app and write down its scopes. Remove any you cannot justify in one sentence. Check expiry dates. Confirm that the bot cannot read secrets by trying from a test workflow.
Review changes in features
Tools add features over time. A bot that could only comment last year may now be able to open fix pull requests or run workflows. Read release notes and re-check permissions when features change.
Quick check
Should a review bot be able to merge?
Not by default. It should read code and comment, and merging should stay behind human approval and required checks.
What guards the CODEOWNERS file itself?
Assigning an owner to the file, so changes to it also need owner review.
Sources
- OWASP GenAI, LLM01 Prompt Injection
- GitHub Docs, About protected branches
- GitHub Docs, About code owners
- GitHub Docs, Copilot code review
Last reviewed: 19 October 2026.
