--- title: "AI agent runs code deployments: safely into production" url: https://knowyouragent.ch/en/knowledge/use-cases/ai-agent-runs-code-deployments lang: en updated: 2026-10-17 license: © Innopulse Consulting GmbH --- # AI agent runs code deployments: safely into production Coding agents are the fastest-growing kind of AI agent. They write code, fix bugs and can take changes all the way to production. There, every change has consequences for customers and security. [Leutrim Miftaraj](https://knowyouragent.ch/en/about/leutrim-miftaraj), Founder, Innopulse Consulting GmbH Published 17 October 2026 ## Key points - Coding agents write code, open changes and can take them all the way to production. - Merging and deploying to production are actions with consequences and belong behind checks and approval. - Signed commits, protected branches and receipts make it traceable which agent shipped what. ## Starting point A development team has an agent fix minor bugs and update dependencies. The agent creates changes, opens pull requests and, with the team's rights, could also merge and deploy. If a manipulated instruction reaches its context through a dependency or a ticket, it could ship harmful code. ## Flow with evidence - **Mandate:** the agent may create branches, change code and open pull requests; merging into the main branch only after review, deploying to production only with approval. - **Change:** the agent signs its commits with its own key. - **Review:** tests and analyses run in CI, and a person reviews the pull request. - **Decision:** before deployment, a decision service checks environment and approval against the mandate. - **Deployment and receipt:** the delivery is recorded with a reference to commit, review and decision. ## Risks and countermeasures - **Injected code:** instructions in tickets, dependencies or tools ([tool poisoning](https://knowyouragent.ch/en/knowledge/glossary/tool-poisoning)) must not reach production unchecked. - **Bypassed reviews:** protected branches prevent the agent from merging itself. - **Secrets in code:** the agent receives no access to production secrets. - **Unclear origin:** signed commits and SLSA provenance show who built what. ## Roles and responsibilities - **Development team:** reviews the agent's pull requests like those of colleagues. - **Platform team:** protects branches and environments and runs the decision service. - **Security:** monitors dependencies and unusual changes. ## How the certificate looks For a production deployment, KYA verifies the mandate, the [approval](https://knowyouragent.ch/en/knowledge/glossary/human-in-the-loop) as a decision and the receipt of the delivery. The verdict is valid. If the agent attempts a deployment without approval, the decision service denies it; a receipt without a matching decision shows a deviation in the execution check. ## Adoption Start with pull requests that people review and merge. Automatic deployments by agents come first in test and staging environments; production stays behind approval. For infrastructure, the use case [AI agent manages cloud resources](https://knowyouragent.ch/en/knowledge/use-cases/ai-agent-manages-cloud-resources) describes the limits. ## Operating metrics The team tracks the share of the agent's merged pull requests, the rate of rolled-back deployments, findings in reviews and denied deployment attempts. A rising rollback rate indicates that the agent's scope is too broad. ## Frequently asked questions ### Should a coding agent be allowed to deploy to production? Only behind review and approval. Pull requests and deployments to test environments can run automatically; production should require human approval. ### How do I prevent an agent from merging its own changes? With protected branches that require reviews and a mandate that does not allow merging into the main branch. ### Why should an agent sign its commits? So it is traceable which changes come from the agent. This helps in reviews and in investigating incidents. ### What is SLSA? A framework for software supply chain security with provenance for built artifacts. It helps trace how an artifact was created. ### What does KYA verify for deployments? Mandate, decision with approval and receipt of the delivery. KYA does not verify code but the evidence of authority. ### May an agent update dependencies on its own? It can open pull requests for updates. They are merged after tests and review, because new versions can contain harmful code. ### How do I handle emergency fixes? Emergency fixes by an agent also go through a pull request with a shortened but human review and are recorded. ### Which rights does a coding agent need? Write access to its own branches, read access to the repository and no access to production secrets or protected branches. ### How do I recognize an agent's changes in the version history? By the commits' signature with the agent's key and by consistent labeling of its pull requests. ### May an agent run database migrations? Migrations can change data and are often irreversible. They belong behind approval, even if the code itself has been reviewed. ### Can an agent roll back a faulty delivery? A prepared rollback step can lie within the mandate, because it restores the previous, reviewed state. It is recorded like any deployment. ## Sources - SLSA: Supply-chain Levels for Software Artifacts: [https://slsa.dev/](https://slsa.dev/) - NIST: Least Privilege: [https://csrc.nist.gov/glossary/term/least_privilege](https://csrc.nist.gov/glossary/term/least_privilege) --- Quelle: https://knowyouragent.ch/en/knowledge/use-cases/ai-agent-runs-code-deployments · KYA – Know Your Agent