Agent Permissions
AI agent permissions checklist for coding teams
Decide what an AI coding agent can read, edit, run, scan, and deploy before it touches real repositories, secrets, databases, or production workflows.
Repository scope
- Grant access to the smallest repo or workspace needed
- Block unrelated monorepos and private customer data
- Require a changed-files summary before review
Secrets and credentials
- Never let agents print tokens or environment variables
- Use write-only secret stores when possible
- Review any new debug endpoint before deploy
Tool and MCP access
- Enable only the MCP servers required for the task
- Separate read-only tools from write/deploy tools
- Log tool calls and verification evidence
Permission questions before enabling a coding agent
Use these questions during vendor review, internal rollout, or MCP server configuration.
Files
Can the agent read and edit only the project files required for this task?
Terminal
Can commands run without unrestricted shell access to secrets or production systems?
GitHub
Can the agent open or update a pull request without bypassing branch protection?
Browser
Can browser checks run against public or staging URLs without exposing admin sessions?
Databases
Is database access read-only, scoped, audited, and separated from production writes?
Deployments
Does deployment require a human-approved command, CI gate, or separate service account?
Security scanners
Do Semgrep, CodeQL, Snyk, or equivalent checks run outside the agent's control?
Evidence
Does the final report include commands run, build output, scan status, URLs checked, and known gaps?
Low-risk starting policy
Allow read access, scoped file edits, tests, builds, and pull request creation. Keep secrets, database writes, billing, and production deploys behind separate approval.
High-risk permissions
Treat production secrets, database mutations, deployment tokens, payment flows, and admin browser sessions as separate capabilities with explicit logging and human approval.
FAQ
What permissions should an AI coding agent have?
Start with read access to the target repo, scoped file edits, test/build commands, and issue or documentation context. Add GitHub, browser, database, or deployment access only when the task truly needs it.
Should coding agents access production secrets?
No by default. Production secrets should live in controlled secret stores and should not be printed, logged, copied into code, or exposed through debug routes for agent convenience.
How do MCP servers change agent permissions?
MCP makes tool access explicit. That helps teams grant a coding agent a narrow GitHub, filesystem, browser, docs, or CI capability instead of giving it a broad, unclear execution environment.
Who should approve AI agent deployments?
Production deployments should be approved through normal release controls: CI, branch protection, deployment tokens, service accounts, and human review for high-risk changes.