gh-auth-isolation

To prevent Enterprise Managed User identity usage for personal pushes, apply GitHub identity isolation to detect the active account and switch contexts safely. This enforces per-operation config separation to avoid cross-account credential actions in agent workflows.

Credential isolation works by using isolated gh config directories or per-command credentials to separate EMU and personal accounts. It temporarily extracts a token for a specific operation without persisting credentials, ensuring secure identity switching.

You need to switch GitHub contexts when an agent defaults to an EMU identity but must perform actions requiring a personal account, such as pushing to personal repos or creating PRs and forks across enterprise and personal projects.

Yes, you can perform a single GitHub push without persisting credentials by temporarily extracting a token for a specific account. This ephemeral credential usage ensures the token is used for one operation and not saved to the environment.

The best way to manage multiple GitHub identities securely is using per-operation config separation to isolate tokens. This approach satisfies requirements for identity detection, token isolation, and ephemeral credential usage to ensure auditable operations.

Yes, gh-auth-isolation works without external dependencies to detect the current gh identity and its token scopes. It performs context switching and isolated config directory management natively within your agent workflows.