Abstract

Autonomous AI coding agents that branch, commit, and push on behalf of a fleet invert the assumption behind conventional continuous-integration (CI) secret handling. CI secret models deliver credentials through environment variables and rely on log masking, because they assume the untrusted principal is a human operator or an external attacker reading build logs — not the code author itself. When the code author is a large-language-model (LLM) agent that runs in-process with the orchestrator, inherits its environment, and can emit arbitrary files and network calls under an auto-accept edit mode, an environment-delivered token becomes an open exfiltration channel and log masking becomes irrelevant. This publication discloses a credential-isolation protocol purpose-built for this AI-insider threat model. Its five cooperating parts are: (1) an env-exclusion discipline and structural guard that keep every credential out of the environment inherited by the AI child process; (2) use-time file-projected tokens — per-repository credentials mounted as read-only files and read only at the instant of use; (3) per-operation URL splicing that injects the correct per-repository token into a single git remote operation, bypassing the host-keyed credential store, paired with inline-credential redaction on all output; (4) a pure, fail-closed tenant-class × repository-class routing matrix in which cross-tenant fallback is structurally blocked and the guardrail is unconditional even while the build capability is dark; and (5) a pre-push target assertion re-verifying the checkout's origin immediately before push, in the runner, outside the AI harness's permission rules. The disclosure is enabling and dated to establish public prior art over the mechanism and, critically, over its combination.

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.

Download

Share

COinS