An AI agent can propose a suppression and gather the evidence, but a person should approve it, especially for anything beyond a clear data error. An agent that can silence its own findings, or the findings that block its own pull requests, has a conflict of interest that no prompt can fix.
The conflict
Coding agents are rewarded for green builds. A failing security gate is an obstacle. An agent with write access to the suppression file can remove the obstacle in one commit. Even a well meaning model may reason its way to "this is a false positive" when it is not, because it wants the task finished.
The control has to be structural: a separate approval, not a polite instruction.
What an agent can safely do
| Action | Allowed? | Condition |
|---|---|---|
| Search code for calls to the vulnerable function | Yes | Output attached as evidence |
| Draft a suppression record with reason and scope | Yes | Marked as proposed |
| Run a test that shows the issue is not triggered | Yes | Test is committed |
| Open a pull request with the proposed entry | Yes | Cannot merge it |
| Approve or merge its own suppression | No | Needs a human approver |
| Edit policy thresholds or the gate | No | Needs a human with the right role |
| Extend an expiring entry | No | Fresh review required |
Guardrails to put in place
- Separate identity. Give the agent its own identity with the narrowest permissions. It should not share a human's token.
- Protected paths. Require code owner review on the suppression file and the gate configuration, and keep the agent out of that owner group.
- Closed reason list. An agent chooses from allowed reasons only.
- Evidence required. No attached output, no entry. The CI check from our machine readable record post can enforce this.
- Rate limits. Alert when an agent proposes many suppressions at once.
- Logging. Record who asked, what the agent saw and what it proposed.
Check the agent's work, not its confidence
Agents write fluent justifications that sound right. Reviewers should open the evidence, run the search themselves for a sample, and confirm the scope is narrow. Our post on AI review false positives discusses where models go wrong.
Fixing beats suppressing
Where a fix exists, an agent is most useful opening an upgrade pull request that a human reviews. That solves the finding instead of hiding it. Our guide on exceptions for AI coding assistants covers wider policy.
Where Safeguard fits
Safeguard offers agent identity, policies, gates and guardrails for AI assisted work, and autonomous remediation with fix pull requests that is off by default with every category set to Manual. Those controls keep a human in the decision.
Review the pattern, not just the entry
Once a week, read the agent's proposals as a set. Look for repeated reasons, repeated packages and unusual timing. A pattern of the same reason for many unrelated packages is a sign the agent is taking a shortcut.
Quick check
Can an agent mark a finding as a false positive?
It can propose that with evidence. A person decides, and the decision is logged.
What if the agent only suppresses low severity items?
Same rule. Low severity findings can change status later, so a human should review the pattern.
Last reviewed: 19 October 2026.
