GitHub GH-600: Implement guardrails and accountability Practice Questions

Branch protection rules with required status checks create a tamper-evident record of every merge event in GitHub's native logs (Option D), and audit log streaming (Option B) captures every API call the agent makes to an immutable external destination—together these satisfy an auditor's need for a comprehensive, trustworthy trail without removing any agent autonomy. Option A (custom YAML manifest) is a plausible but fragile pattern: if the agent or its token is compromised the manifest can be tampered with, and it duplicates what GitHub's built-in audit log already provides. Option E eliminates agent autonomy entirely, which violates the goal of preserving delivery velocity. Option C (scheduling) reduces throughput and does not itself produce an audit trail—it is an operational constraint, not an accountability mechanism.

Merging into the main branch of a production-gating repository is the highest-risk action among the four: it directly affects what ships to production, is subject to SOC 2 change-management controls, and is difficult to reverse quickly if a bad merge causes an incident. It therefore requires the lowest autonomy (most human oversight). Option D is low-risk because it targets a non-production branch and CI validation has already passed—high autonomy is appropriate. Option C is purely informational and non-destructive; it can safely be fully automated. Option A is a lightweight, reversible repository operation with no direct compliance impact, suitable for full automation.

Option E (URL allowlisting) is a direct output guardrail: even if the agent is tricked into calling the webhook API, only pre-approved domains can be registered, neutralizing data exfiltration. Option C (human approval for user-input-triggered webhook changes) applies the human-in-the-loop control precisely to the high-risk, compliance-sensitive action class, blocking the attack path before it reaches the API. Option F (prompt-injection guard) addresses the root cause—the attacker's ability to hijack the agent's decision-making via crafted input—by intercepting malicious instructions before the agent acts on them. Option D (narrowing installation scope) is a good least-privilege practice but does not prevent the attack within the permitted repositories; it only limits blast radius. Option A is wrong and counterproductive: a longer-lived token increases risk, not security, and is unrelated to the webhook injection vector. Option B (archiving repositories) is a disproportionate, disruptive response that harms legitimate users and does not systematically prevent the attack class.

Scoping secrets to the specific jobs that need them—using job-level environment definitions or separate workflows—removes the agent's implicit access to unrelated secrets without touching the permissions it legitimately needs ('contents: write', 'pull-requests: write'). This preserves delivery velocity while enforcing least privilege. Option D unnecessarily eliminates core agent functionality and kills velocity. Option B (secret rotation after every run) is operationally expensive, does not prevent the agent from reading secrets during the run, and does not address the root scoping problem. Option C replaces fine-grained GITHUB_TOKEN permissions with a broad PAT, which actually increases risk by granting access beyond what the GitHub Actions permission model would allow and centralizes a high-value credential.

Closing an issue is a consequential, difficult-to-reverse action: a misclassified closure silences a legitimate bug report and erodes user trust, making it compliance-sensitive and a candidate for human-in-the-loop review. This directly maps to the guardrail principle of requiring explicit authorization for irreversible or high-impact changes. Option A is wrong—API cost and Actions minutes are not the basis for authorization requirements in Responsible AI guardrail design. Option B is wrong—closing issues uses the same 'issues: write' permission scope as commenting and labeling; there is no inherent permission conflict. Option C is wrong—rate limits are an operational concern, not a risk classification or compliance justification for human approval.