Selected repositories
Give the agent a bounded code surface.
Grant the repositories this task needs instead of handing an agent a broad token for every repository the human can access.
GitHub authority in the product
The Agent identity carries the repository and branch boundary. Ask mode can then pause the exact pull request call before GitHub receives it.


What stays bounded
The useful default is branch first: use a configured VM, container, or local machine to inspect and test the code; use ExecWarden-mediated GitHub authority for the review branch and PR.
Selected repositories
Grant the repositories this task needs instead of handing an agent a broad token for every repository the human can access.
Review branch
The safer default is branch first, checks and diff second, merge authority last.
Evidence
Each activity record can show the caller, capability, grant, approval decision, and provider result.
Where teams start
Start a coding task
The fastest first test is a coding task that ends in a branch, test output, and a PR someone can inspect.