Agentic SDLC Controls

An agent in your pipeline acts with your credentials, at machine speed, without getting tired of a repetitive task. That is the point of it, and it is also the threat model. Review the boundary, not the agent's intentions.

Applies to any coding agent with write access — Claude Code, Codex, Cursor, OpenCode, or a CI job that calls a model. Nothing here depends on which one.

1. Establish What the Agent Can Actually Reach

Inventory before opinion. For each agent or automation:

• Identity: whose credentials does it run as? A named service identity, or a human's personal token?
• Repositories: read, write, or admin? Can it push to a default branch, or only open a PR?
• Environments: can it reach staging? production? a customer's data?
• Secrets: which values are in its environment at runtime, and which of those does its task actually require?
• Network: can it make arbitrary outbound calls, or is egress restricted?

Write this down as a table. The common finding is not a subtle misconfiguration — it is that nobody had the list.

2. Separate Reversible from Irreversible