An AI agent should never approve its own security exception

I’m uncomfortable giving a coding agent authority to approve its own security exceptions. If it modifies CI rules, suppresses a scan failure, widens permissions, or waives a dependency policy while completing a task, it can also shape the evidence used to argue that the exception is safe.

Passing ordinary tests does not resolve that conflict. The tests may be green precisely because the agent changed what runs, what blocks merging, or what the workflow can access. That is a governance problem, not just a test-coverage problem.

I also don’t want a human reviewer dragged into every low-risk configuration change and creating a permanent bottleneck. Would a separately managed policy engine, mandatory two-person review for higher-risk changes, or time-limited exceptions provide real separation—or just ceremony around an already trusted agent? I’d like to hear what workflows people are actually using, or a better control I’m missing.

The policy engine only helps if the agent cannot alter its policy, inputs, evaluator, or enforcement path. Otherwise it is just another file in the repo with a more official name. I’d keep low-risk changes automatic, but make permission changes and suppressed findings cross a hard boundary.

Time limits are useful containment, not independence. They reduce how long an exception persists, but they do not stop self-renewal unless renewal is owned elsewhere. I’d want the exception reason, scope, expiry, and approving role recorded separately from the agent’s change.

Two people for every warning sounds like a queue nobody will respect. A risk tier seems more workable: dependency noise might get an automated, short-lived waiver, while CI permission changes require a human who cannot be the agent. The hard part is defining that boundary without making it arbitrary.

I’m not convinced “separate” automatically means “safer.” A human can rubber-stamp a prompt, and a policy service can enforce a bad rule perfectly. The useful test is whether the approver has different authority, different evidence, and a reason to investigate—not whether another checkbox appears in the workflow.