agent-authorization-matrix

What problem does it solve?

This Skill creates a clear, deny-by-default policy for what AI agents may do autonomously and what must always be approved by a named human, preventing authority drift, unsafe merges, and accidental deployments.

Core Features & Use Cases

• Agent Action Governance: Defines which agent actions are autonomous, approval-required, or forbidden across read, edit, test, commit, push, PR, merge, deploy, secrets, and history rewrites.
• Merge and Auto-Merge Safety: Enforces the non-negotiable rule that protected-branch merges require human approval and that agents can never arm auto-merge.
• Incident Recovery: Used after autonomy incidents to revise standing permissions and codify the corrected authority model for future runs.
• Use Case: A security PR is ready, but the matrix forces the agent to stop after opening the PR, re-check auto-merge state, and hand the merge decision to a human.

Quick Start

Ask the agent to draft or revise the repo’s deny-by-default authorization matrix for coding agents, including merge, deploy, and auto-merge rules with approval scope and expiry.