AI agent runs code deployments: safely into production

Key points

Coding agents write code, open changes and can take them all the way to production.
Merging and deploying to production are actions with consequences and belong behind checks and approval.
Signed commits, protected branches and receipts make it traceable which agent shipped what.

Starting point

A development team has an agent fix minor bugs and update dependencies. The agent creates changes, opens pull requests and, with the team's rights, could also merge and deploy. If a manipulated instruction reaches its context through a dependency or a ticket, it could ship harmful code.

Flow with evidence

Mandate: the agent may create branches, change code and open pull requests; merging into the main branch only after review, deploying to production only with approval.
Change: the agent signs its commits with its own key.
Review: tests and analyses run in CI, and a person reviews the pull request.
Decision: before deployment, a decision service checks environment and approval against the mandate.
Deployment and receipt: the delivery is recorded with a reference to commit, review and decision.

Risks and countermeasures

Injected code: instructions in tickets, dependencies or tools (tool poisoning) must not reach production unchecked.
Bypassed reviews: protected branches prevent the agent from merging itself.
Secrets in code: the agent receives no access to production secrets.
Unclear origin: signed commits and SLSA provenance show who built what.

Roles and responsibilities

Development team: reviews the agent's pull requests like those of colleagues.
Platform team: protects branches and environments and runs the decision service.
Security: monitors dependencies and unusual changes.

How the certificate looks

For a production deployment, KYA verifies the mandate, the approval as a decision and the receipt of the delivery. The verdict is valid. If the agent attempts a deployment without approval, the decision service denies it; a receipt without a matching decision shows a deviation in the execution check.

Adoption

Start with pull requests that people review and merge. Automatic deployments by agents come first in test and staging environments; production stays behind approval. For infrastructure, the use case AI agent manages cloud resources describes the limits.

Operating metrics

The team tracks the share of the agent's merged pull requests, the rate of rolled-back deployments, findings in reviews and denied deployment attempts. A rising rollback rate indicates that the agent's scope is too broad.

Frequently asked questions

Should a coding agent be allowed to deploy to production?

Only behind review and approval. Pull requests and deployments to test environments can run automatically; production should require human approval.

How do I prevent an agent from merging its own changes?

With protected branches that require reviews and a mandate that does not allow merging into the main branch.

Why should an agent sign its commits?

So it is traceable which changes come from the agent. This helps in reviews and in investigating incidents.

What is SLSA?

A framework for software supply chain security with provenance for built artifacts. It helps trace how an artifact was created.

What does KYA verify for deployments?

Mandate, decision with approval and receipt of the delivery. KYA does not verify code but the evidence of authority.

May an agent update dependencies on its own?

It can open pull requests for updates. They are merged after tests and review, because new versions can contain harmful code.

How do I handle emergency fixes?

Emergency fixes by an agent also go through a pull request with a shortened but human review and are recorded.

Which rights does a coding agent need?

Write access to its own branches, read access to the repository and no access to production secrets or protected branches.

How do I recognize an agent's changes in the version history?

By the commits' signature with the agent's key and by consistent labeling of its pull requests.

May an agent run database migrations?

Migrations can change data and are often irreversible. They belong behind approval, even if the code itself has been reviewed.

Can an agent roll back a faulty delivery?

A prepared rollback step can lie within the mandate, because it restores the previous, reviewed state. It is recorded like any deployment.

Sources

SLSA: Supply-chain Levels for Software Artifacts: https://slsa.dev/
NIST: Least Privilege: https://csrc.nist.gov/glossary/term/least_privilege