Safe AI-Assisted Draft PR Workflow

Letting an AI agent create pull requests sounds useful—but it can quickly become a security nightmare if the agent gets raw GitHub access. This is why most teams start with something narrower: a safe draft PR workflow that proves the concept without opening the door to chaos. Many teams want agents to help with routine engineering work: update docs, fix small issues, open draft pull requests and run tests. The dangerous part is giving an agent raw write access without a narrow workflow.

A safe draft PR workflow is a good first use case for agent capabilities because it is useful, concrete and has clear policy boundaries.

Unsafe version

Agent gets:
- github.create_branch
- github.commit_files
- github.create_pull_request
- shell.run

Safe version

Agent gets:
- create_safe_draft_pr

The capability describes the workflow and hides low-level steps behind policy.

Recommended policy

• Require branch prefix such as gpt/ or ai/.
• Force pull requests to be draft.
• Block secret-like paths.
• Limit changed files and diff size.
• Run tests or record why tests were not run.
• Audit original input, mutated input and final result.

Actlane manifest sketch

kind: Capability
metadata:
  name: create-safe-draft-pr
spec:
  policyRef:
    name: safe-gitops-policy
  execution:
    tools:
      - sandbox.run_tests
      - github.create_branch
      - github.commit_files
      - github.create_pull_request
  targets:
    - mcp
    - openapi
    - opencode
    - policyBundle

Why this is a strong first workflow

It proves the value of typed inputs, agent instructions, policy checks and generated integrations without requiring a full enterprise control plane.