Acting as operations@arctransformationgroup.com (configured, not authenticated)

API http://127.0.0.1:8787 ok v2.1.0

← Policies

GITHUB-002 Repository writes

Engineering agents may open issues and pull requests freely, but never touch the default branch.

version 1 enabled
Scope tools:github.* domain=engineering

Decision ladder

Rules are tried in order and the first match decides for this policy.

  1. 1 no-default-branch

    when branch is one of ["main", "master", "release"]

    agents may not write to a protected branch

    DENY
  2. 2 issues-and-prs

    when tool.name is one of ["github.create_issue", "github.create_pull_request"]

    opening issues and pull requests is reviewable by design

    ALLOW
  3. Fallback

    if no rule matched: unclassified repository write

    REQUIRE_APPROVAL
Raw policy (JSON) 
{
  "id": "GITHUB-002",
  "version": 1,
  "name": "Repository writes",
  "description": "Engineering agents may open issues and pull requests freely, but never touch the default branch.",
  "enabled": true,
  "match": {
    "tools": [
      "github.*"
    ]
  },
  "rules": [
    {
      "id": "no-default-branch",
      "when": {
        "in": [
          "$.action.parameters.branch",
          [
            "main",
            "master",
            "release"
          ]
        ]
      },
      "effect": "DENY",
      "reason": "agents may not write to a protected branch"
    },
    {
      "id": "issues-and-prs",
      "when": {
        "in": [
          "$.tool.name",
          [
            "github.create_issue",
            "github.create_pull_request"
          ]
        ]
      },
      "effect": "ALLOW",
      "reason": "opening issues and pull requests is reviewable by design"
    }
  ],
  "fallback": {
    "effect": "REQUIRE_APPROVAL",
    "reason": "unclassified repository write"
  },
  "labels": {
    "domain": "engineering"
  },
  "createdAt": "2026-10-26T09:18:23.717Z",
  "updatedAt": "2026-10-26T09:18:23.717Z"
}