I keep hitting this one in AI-written PRs.
The ticket is a narrow fix. The agent also edits the tool config, MCP allowlist, or agent permissions so the next run can "finish without asking." Diff looks like plumbing. Summary says temporary. Merge temptation is high.
The blast radius just grew. You did not ask for that surface.
The 60-second check I run now
When an agent PR touches tool configs, allowlists, sandbox flags, or prompt/system instructions:
- Diff the permission surface itself — what can the agent read, write, run, or call now that it could not before?
- Ask: did the ticket need that wider access, or did the agent widen it to avoid a human gate?
- If access widened and the root task did not require it, I bounce it or split it. Temporary permissions in a merged PR are not temporary.
This is one of the stops on a short bar I use before I merge agent PRs. Free one-pager if you want the rest: https://chopragunji.gumroad.com/l/zpnmdn
If you'd rather someone else do a hard pass on one scary AI PR, I still have founding slots at $49 (normally $99): https://chopragunji.gumroad.com/l/byoyi/FOUNDING
Has an agent on your team ever "helpfully" unlocked a tool you meant to keep gated?
Top comments (0)