# Give an agent GitHub access without letting it merge or leak code

Source code is crown-jewel data, and a merge or a public repo is a one-call mistake. Keep the agent to drafts and keep secrets out of commits.

For: Engineering and platform teams running an agent against GitHub

GitHub holds the most sensitive asset an agent can reach — the source itself — and two of its actions are effectively irreversible in the ways that matter: merging a change, and making a private repo public. Both are a single tool call.

These ingress policies keep the agent in a draft-and-propose lane. `require-human-approval-merge` lets it open and review but never consummate a merge; `deny-public-exposure-repos` blocks flipping a repo, gist, or page to public and forces `private: true`. `block-secrets-commits` denies commits whose contents carry live credentials, and `fence-scopes-org-allowlist` keeps the agent inside your own organizations rather than pushing to arbitrary destinations. For reads, `redact-secrets-egress` masks tokens and keys that already sit in the tree before they reach the model.

The result maps cleanly onto change-management expectations: an agent can draft the work, but a human still owns the merge and nothing goes public by accident.

## Policies in this guide

- [Require Human Approval: GitHub Merges & Approvals](https://www.intentbasedpolicy.com/policies/github/require-human-approval-merge) — Keeps a human in the loop on the two GitHub actions that consummate a code change: merging a pull request and approving one .
- [Prevent Public Exposure of GitHub Repos, Gists & Forks](https://www.intentbasedpolicy.com/policies/github/deny-public-exposure-repos) — Stops the agent from exposing private code to the public across three GitHub write tools, at ingress — before the call reaches the GitHub MCP server, so a…
- [Block Secrets in GitHub Commits & PRs](https://www.intentbasedpolicy.com/policies/github/block-secrets-commits) — Blocks GitHub write tool calls whose payload looks like it carries a live credential into a repository, gist, pull request, or comment.
- [GitHub: Redact Secrets from Read Responses](https://www.intentbasedpolicy.com/policies/github/redact-secrets-egress) — Scans the responses of GitHub's crown-jewel read tools and masks known credential shapes with a fixed [REDACTED-SECRET] marker before the text enters agent…
- [Fence GitHub Access to the Company Org Allowlist](https://www.intentbasedpolicy.com/policies/github/fence-scopes-org-allowlist) — Denies any GitHub tool call whose arguments.owner (read from input.payload.args.