AI Security

Safely Granting a Coding Agent Access to a Private GitHub Repository with Deploy Keys and Fine‑Grained Tokens

Published 2026-09-26 by AISecAll Editorial

TL;DR: Use a read‑only deploy key for cloning, a fine‑grained personal access token (PAT) limited to the exact repository and actions the agent needs, enforce branch protection, rotate keys weekly, and log every Git operation. This limits blast radius, satisfies audit requirements, and keeps the agent from accidentally pushing secrets or breaking production.

Why a Dedicated Access Strategy Matters

AI coding agents (e.g., OpenAI Agents, Claude Managed Agents) often need to read source code, generate patches, or push small fixes. Granting them full repository permissions is a classic “all‑or‑nothing” mistake that can lead to data exfiltration, supply‑chain attacks, or accidental overwrites. Applying the OWASP GenAI Security Project principles of least‑privilege and explicit trust boundaries reduces those risks.

Choose the Right Authentication Mechanism

Three native GitHub mechanisms can be used:

1. Deploy keys – SSH keys attached to a single repository, read‑only by default.
2. Fine‑grained personal access tokens (PATs) – Scoped to specific repositories and actions (read, write, pull‑request). Introduced in 2022, they replace classic PATs for better granularity.
3. GitHub Apps – Offer the most control (install per‑repo, granular permissions), but require additional setup and a server to handle JWT signing.

For most small teams, a combination of a read‑only deploy key (for cloning) and a fine‑grained PAT (for creating pull requests) provides the simplest yet secure workflow.

Step‑by‑Step: Deploy‑Key‑Only Read Access

# 1. Generate an SSH key pair (no passphrase)
ssh-keygen -t ed25519 -C "ai‑agent‑deploy‑key" -f ./ai_agent_key -N ""

# 2. Add the public key to the target repo as a Deploy Key
#    (GitHub UI → Settings → Deploy keys → Add deploy key → Enable "Allow write access" *off*)

# 3. Store the private key securely – e.g., in a secret manager like Cloudflare Workers KV or HashiCorp Vault.

# 4. Configure the agent to use the key when cloning
export GIT_SSH_COMMAND="ssh -i /path/to/ai_agent_key -o StrictHostKeyChecking=no"
git clone [email protected]:your‑org/your‑repo.git

This gives the agent read‑only access to the repository’s current state. It cannot push changes, create branches, or read other repos.

Step‑by‑Step: Fine‑Grained PAT for Pull‑Request Creation

# 1. In GitHub, go to Settings → Developer settings → Fine‑grained tokens → Generate new token.
#    Scope:
#      • Repository permissions → Select the target repo only.
#      • Permissions → "Read and write" on Pull requests, "Read" on Contents.
#      • No access to "Administration" or "Secrets".
#    Expiration: 30 days (or shorter for CI).

# 2. Store the token as a secret (e.g., in Cloudflare Workers KV, AWS Secrets Manager).

# 3. Use the token in the agent’s HTTP calls to the GitHub REST API.
curl -X POST -H "Authorization: Bearer $GITHUB_TOKEN" \
     -H "Accept: application/vnd.github+json" \
     https://api.github.com/repos/your-org/your-repo/pulls \
     -d '{"title":"AI‑generated fix","head":"ai/patch","base":"main"}'

Because the token is limited to a single repository and to pull‑request actions, the agent cannot enumerate other repos, delete branches, or modify settings.

Enforce Branch Protection and Review Gates

Even with limited permissions, an agent could push a malicious change if write access is inadvertently granted. Apply GitHub’s branch protection rules:

• Require at least one human review before merging.
• Disallow force pushes and deletions on protected branches.
• Enable status‑check enforcement for CI linting or security scans.

These safeguards keep the AI‑generated code in a pull request until a team member approves it.

Rotate Keys and Tokens Regularly

Static credentials are a gold mine for attackers. Adopt a rotation schedule:

• Deploy keys: regenerate every 30 days, update the secret store, and delete the old key from GitHub.
• PATs: set a short expiration (7‑14 days) and automate renewal via a CI job that requests a new token using a GitHub App with administration:write on the app itself only.

Automating rotation eliminates manual slip‑ups and ensures that compromised credentials become useless quickly.

Audit Logging and Alerting

Combine GitHub’s native audit log with your own observability pipeline:

1. Enable OpenAI Agents request‑level logging (if you use OpenAI’s SDK) to capture every git command the agent runs.
2. Forward GitHub’s audit events (e.g., "git.clone", "pull_request.open") to a SIEM or a simple webhook that writes to a spreadsheet.
3. Set alerts for unusual patterns: cloning the repo more than X times per hour, or a pull request opened from a non‑human actor.

This visibility lets you spot a misbehaving agent before it impacts production.

Incident Response Checklist for a Misbehaving Agent

• Contain: Revoke the deploy key and PAT immediately from GitHub.
• Assess: Review the audit log for any pushes, secret reads, or external API calls made by the agent.
• Remediate: If code was merged, revert the pull request and run a full security scan on the repository.
• Post‑mortem: Update the permission matrix, tighten scope, and document the event for future audits.

Quick Checklist for Small Teams

Following this checklist gives you a repeatable, low‑maintenance process that scales as your AI‑driven tooling grows.

When to Upgrade to a GitHub App

If your agent needs to interact with multiple repositories, or you want to enforce per‑installation permissions, consider a GitHub App. Apps can request granular permissions (e.g., "contents:read", "pull_requests:write") and can be installed on a subset of repos. The trade‑off is added complexity: you must host a JWT signer and handle token refresh.

Bottom Line

For most small companies, the combination of a read‑only deploy key plus a fine‑grained PAT—backed by branch protection, rotation, and audit logging—delivers the security you need without the overhead of a full‑blown GitHub App. It keeps the AI coding agent productive while protecting your codebase and any embedded secrets.

Need help implementing these controls or integrating them into your existing AI workflow? AISecAll can design a tailored, zero‑trust access model for your team.