When agents write code, who should get deployment permissions?
The Tessl blog proposes that agents can write code and suggest fixes, but should not have permission to deploy to production; deployment permissions should be given to the CI/CD pipeline. The article cites a case from the Cline repository: a malicious issue title can induce its triage agent to install a package from an attacker's fork, and via a shared build cache steal an npm token to publish an unauthorized version. The author advocates treating everything an agent reads as untrustworthy, and replacing manual code review with short-lived OIDC identities, hash-locked dependencies, and an independent verifier.

The Tessl blog proposes that agents can write code and suggest fixes, but should not have permission to deploy to production; deployment permissions should be given to the CI/CD pipeline. The article cites a case from the Cline repository: a malicious issue title can induce its triage agent to install a package from an attacker's fork, and via a shared build cache steal an npm token to publish an unauthorized version. The author advocates treating everything an agent reads as untrustworthy, and
Matched fieldsBody






