💡 Agent Credential Isolation Standard for CI Workflows

[github-actions[bot]]

Summary

Define and enforce a credential isolation standard for all AI agent CI jobs, ensuring agents operate with minimal tool access and no exposure to unnecessary environment variables. Covers --allowed-tools enforcement, environment variable scrubbing, and per-workflow token scoping.

Market Signal

The "Comment and Control" attack class (disclosed April 2026, CVSS 9.4) demonstrated that AI coding agents (Claude Code, Gemini CLI, Copilot Agent) can be weaponized via PR titles and issue comments to dump all environment variables including API keys and GitHub tokens. The Cloud Security Alliance published a research note on prompt injection in AI-powered GitHub Actions in May 2026. Security researchers confirmed the attack uses GitHub's own APIs as the exfiltration channel — no external server required. Anthropic, Google, and GitHub all patched but none issued CVEs, leaving organizations to self-assess exposure.

User Signal

Issue #291 (wire agentic responses to trusted bot reviews and CI failures) shows active work expanding bot-agent interaction surfaces. Merged PR #245 (claude-fix-review-comments job) and PR #198 (trigger Claude on CodeRabbit/Copilot comments) demonstrate growing agent touchpoints in CI. More touchpoints = more credential exposure. The existing Agent Shield v2 discussion (#269) handles input scanning but not runtime credential isolation — this proposal addresses the complementary runtime layer.

Technical Opportunity

The claude-code-reusable.yml workflow already invokes Claude with configurable parameters. Three concrete changes address the gap:

1. --allowed-tools enforcement: Add tool allowlists to all claude-code-action invocations, restricting agents to only the tools they need (e.g., Read, Grep, Bash for review — not file write or network access)
2. Environment variable scrubbing: Document which env vars each agent workflow needs and clear the rest before agent execution, preventing env / printenv exfiltration
3. Compliance audit check: Add a check to compliance-audit.sh that verifies all agent-invoking jobs use --allowed-tools and don't expose unnecessary secrets

The discussion-mutations.sh pattern (wrapper functions with DRY_RUN support) shows the team's approach to safe mutation control — the same pattern applies to agent credential control.

Assessment

Dimension	Score	Rationale
Feasibility	med	Requires auditing all agent workflows and defining per-workflow tool/env allowlists — non-trivial but well-scoped
Impact	high	Directly addresses the CVSS 9.4 attack vector — prevents credential exfiltration from compromised agents
Urgency	high	Active exploitation demonstrated; agent surface area is expanding with every new workflow

Adversarial Review

Strongest objection: Building in-house runtime governance is aspirational — commercial solutions like Repello AI exist. And restricting agent tools could break legitimate functionality.

Rebuttal: This is NOT a commercial runtime governance product. It is three wrapper-level changes: (1) add --allowed-tools to invocations, (2) scrub unnecessary env vars, (3) add compliance audit checks. The alternative — doing nothing — means accepting that any malicious PR can exfiltrate API keys. The risk of over-restriction is mitigated by starting with review-only workflows (read-only tool allowlist) and expanding gradually.

Suggested Next Step

Audit all agent-invoking workflows (claude-code-reusable.yml, agent-shield-reusable.yml) for unnecessary credential exposure, add --allowed-tools configuration, and create a "credential isolation" section in ci-standards.md.