Run a coding agent on a laptop for interactive work where a human watches each step, and in CI for narrow, repeatable tasks with a scoped token and fixed steps. Most teams end up with both. Choose by task, and give each location its own limits.
Two places, two risk profiles
On a laptop, the agent sits next to your credentials, browser sessions, and personal files. A human is present, which helps. But the environment is broad and varies from machine to machine.
In CI, the environment is clean and repeatable, with logs by default. But the run is often unattended, and the pipeline may hold deployment secrets.
Comparison
| Factor | Laptop | CI runner |
|---|---|---|
| Human watching | Usually | Rarely |
| Blast radius if hijacked | Everything on the machine | Whatever the token and secrets allow |
| Environment consistency | Low | High |
| Logging | Depends on the tool | Pipeline logs by default |
| Best tasks | Exploration, refactors, explanation | Triage, formatting, scheduled maintenance |
| Main control | Permissions and sandbox | Token scope and fixed steps |
Rules for the laptop
Apply the permission matrix: project scope, command allow list, no production credentials. Prefer a sandbox or devcontainer for unfamiliar repositories.
Rules for CI
- Scope the token. GitHub's documentation advises granting the workflow token the least required access, and shows setting the permissions key at the job level, for example contents read and issues write. It also notes that an action can read the token from the context even if you do not pass it, so limiting permissions is the main safeguard.
- Remember tokens expire. The documentation states the workflow token expires when the job finishes or after its maximum lifetime.
- Do not feed untrusted text to a privileged job. An agent that reads issue text from strangers and holds write access is the combination to avoid.
- Fixed steps over open ended shells. Give the CI agent a short list of commands.
- Gate the output. Let it open a pull request, never merge one.
A decision guide
Ask three questions for each task.
- Does it need a human to judge as it goes? Laptop.
- Is it the same steps every time? CI.
- Does it touch untrusted input and privileged access together? Redesign, or split into two steps with a human between.
Do not forget the pipeline files
Workflow definitions control what the agent can do in CI. Protect them with code owner review so an agent or contributor cannot widen its own permissions. See protecting workflow files with CODEOWNERS.
Try it yourself
Click through it at your own pace, or open it full screen.
Notice how a gate sits between the agent's change and the merge, whichever place the agent ran.
Safeguard offers pull request gates and policies that apply the same checks regardless of where the change came from.
Quick check
Is CI safer than a laptop?
Not automatically. It is more consistent and better logged, but often unattended and close to deployment secrets.
Can the CI agent merge its own change?
No. Keep merge behind branch protection and human review.
Sources
Last reviewed: 19 October 2026.
