[FAQ] Add: external admission authority via environment protection rules#28936
[FAQ] Add: external admission authority via environment protection rules#28936
Conversation
Adds a new entry under Guardrails answering the question of whether external human approval can be required before safe outputs are applied. Explains the guardrail-vs-admission distinction and documents the GitHub Environment protection rules pattern for fail-closed external admission gates using custom safe output jobs. Closes github/agentic-workflows#484 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
❌ Smoke Temporary ID encountered failures. Check the logs for details. |
Comment MemoryNote This comment is managed by comment memory.It stores persistent context for this thread in the code block at the top of this comment. |
| For a fail-closed **external admission gate** before sensitive operations like deployments or credential use, apply **[GitHub Environment protection rules](https://docs.github.com/en/actions/managing-workflow-runs-and-deployments/managing-deployments/managing-environments-for-deployment#required-reviewers)** to a [custom safe output job](/gh-aw/reference/custom-safe-outputs/). The job pauses until a designated reviewer outside the workflow system explicitly approves. No approval means no execution. | ||
|
|
||
| ```yaml wrap | ||
| safe-outputs: |
There was a problem hiding this comment.
@copilot declare job that needs detection and add this job to safe-outputs.needs to interleave manual confirmation before the safe outputs job
There was a problem hiding this comment.
Updated in f2438b3. The example now declares a top-level approval-gate job with needs: detection (so it runs after automated threat scanning) and uses safe-outputs.needs: [approval-gate] to interleave the manual reviewer confirmation before the built-in safe_outputs job runs.
…afe-outputs.needs Agent-Logs-Url: https://github.com/github/gh-aw/sessions/7f90a3d5-3450-4da8-b7fc-673093cdfe0e Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Adds a new FAQ entry under the Guardrails section addressing whether external human approval can be required before safe outputs are applied.
What changed
New entry: "Can I require external human approval before safe outputs are applied?"
The entry:
Source
Sourced from community discussion feedback captured in github/agentic-workflows#484. This is a new entry — no existing FAQ entry covered external admission authority.
Type
New FAQ entry added to existing Guardrails section.