In short
Sensitive directories — auth, billing, payments, secrets — are off-limits. RunGuard checks protected paths before dispatch and again before accepting the agent’s output. It’s enforced, not a polite line in a prompt.
Every change an agent proposes arrives as a pull request a human reviews. RunGuard never merges, and never enables auto-merge. The agent opens the door; a person walks through it.
The agent receives a crash packet and a narrow task — "investigate this error and propose a small, reviewable fix" — not "go fix the codebase." Tight scope is what keeps output reviewable.
The agent runs on your GitHub Copilot seat or your Anthropic key, inside your own GitHub. RunGuard orchestrates the handoff and never holds your LLM credentials.
When an error isn’t cleanly reproducible, the task asks for a draft investigation rather than a speculative fix — so low-confidence work shows up as notes to review, not risky code.
Every incident records which executor it went to, its status, and the linked PR. You can always answer "what did an agent touch, and when" from one timeline.
AI coding agents that touch production code need guardrails enforced by infrastructure, not by prompt instructions a crafted input can override: protected paths as a hard gate, no auto-merge, scoped review-grade context, customer-owned credentials, a low-confidence path that produces an investigation instead of a guess, and auditable status. RunGuard applies these before an agent is dispatched and again before its output is accepted.
It is safe when the boundaries are enforced outside the agent. With protected paths as a hard gate, no auto-merge, and a scoped task, the worst case is a pull request you decline — not unreviewed code shipped to production. The risk lives in setups where the only guardrail is the prompt.
Because review is where hallucinated, incomplete, or out-of-scope fixes get caught. Auto-merging removes the one human checkpoint that stands between a plausible-looking diff and your production branch. RunGuard never auto-merges; the fix is always a PR.
Protected paths are directories an agent is not allowed to modify — typically auth, billing, payments, and secrets handling. In RunGuard they are a hard gate: the check runs before an incident is dispatched and again before any output is accepted, so the agent can’t touch them even if it tries.
No. If a tool boundary exists only as a line in the system prompt, a crafted input or an over-eager model can step around it. Guardrails that matter — what files are off-limits, whether code can merge itself — have to live in the infrastructure, where they can’t be prompted away.
You do. The agent runs on your own GitHub Copilot seat or your own Anthropic key, inside your own GitHub. RunGuard orchestrates routing, safety, and tracking, and never holds your LLM credentials.
Connect a repo, set protected paths, and route incidents to your own agent — with the boundaries enforced where they can’t be prompted away.