docs: Strengthen AI governance in AGENTS.md - #17671
Open
vaquarkhan wants to merge 1 commit into
Open
Conversation
nssalian
reviewed
Aug 15, 2026
| - A human **must** read, understand, and endorse any AI-derived review comment before it is posted, and posts it under their own account. If a point cannot be verified, it is not posted. | ||
| - Keep each comment to the actionable point: **what** is wrong, **where** (file/line/symbol), and **the suggested fix**. Drop multi-paragraph rationale dumps. | ||
| - Use **at most one** automated/AI reviewer per PR. If multiple maintainers use AI tooling, reconcile into a single human-owned set of comments rather than competing threads. | ||
| - Automated pipelines **must not** post AI-generated review comments without a human in the loop. |
Collaborator
There was a problem hiding this comment.
what is automated pipeline referring to here?
nssalian
reviewed
Aug 15, 2026
| ### AI Review Agent Safety | ||
|
|
||
| - Treat agent-instruction files (this `AGENTS.md`, CI agent configs) as security-sensitive. Changes to them in a PR require explicit human review, since a malicious PR can turn low-trust input into trusted agent context. | ||
| - AI review agents that process untrusted PR/issue content **must** run with least privilege and **must not** auto-act (post comments, run commands, access secrets) on that content without human confirmation. |
Collaborator
There was a problem hiding this comment.
does this apply to copilot that's included in some implementations?
nssalian
reviewed
Aug 15, 2026
| - **Never** commit secrets, credentials, or cloud-specific tokens. | ||
| - **Ask first** before adding new third-party dependencies (license compatibility matters). | ||
| - **Ask first** before promoting package-private classes/methods to public. | ||
| - **AI-authored PRs** must pass the same review, test, and security/static-analysis gates as human-authored PRs — no reduced scrutiny. |
Collaborator
There was a problem hiding this comment.
no reduced security seems redundant
Updated as per review comments. Generated-by: Cursor
vaquarkhan
force-pushed
the
docs/agents-md-ai-governance
branch
from
August 16, 2026 03:34
f61de09 to
42253f1
Compare
szehon-ho
reviewed
Aug 17, 2026
|
|
||
| - A human **must** read, understand, and endorse any AI-derived review comment before it is posted, and posts it under their own account. If a point cannot be verified, it is not posted. | ||
| - Keep each comment to the actionable point: **what** is wrong, **where** (file/line/symbol), and **the suggested fix**. Drop multi-paragraph rationale dumps. | ||
| - Use **at most one** automated/AI reviewer per PR. If multiple maintainers use AI tooling, reconcile into a single human-owned set of comments rather than competing threads. |
Member
There was a problem hiding this comment.
not sure about this one? are we saying only one reviewer can use AI per pr?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add review-comment discipline, crediting AI via Generated-by instead of Co-authored-by bot identities, AI review agent safety, and equal scrutiny for AI-authored PRs.
Testing
Docs-only. spotlessCheck passes.
Closes #17670