GitHub · GH-600
Guardrails and least privilege
GH-600 · Lesson 16 of 16 · 2:10:18
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the GH-600 exam (GitHub Certified: Agentic AI Developer). In this lesson: blocking policy violations with rulesets, code owner reviews, push protection, and preToolUse hooks, least privilege for workflows, secrets, tokens, and third-party actions pinned to a full commit SHA, controlled paths for irreversible changes with environments, required reviewers, and break-glass procedures, and preserving velocity by removing approvals that do not reduce risk, with a regular review of the guardrails. Includes three original practice questions.
Preview the topics
- An agent’s workflow at Contoso grants write access to contents and pull requests at the workflow level, although only one of its four jobs writes anything. What should change?
- A Contoso developer started a production deployment that an agent prepared, and the same developer is a required reviewer of the production environment. How do you stop the developer from approving that deployment?
- Contoso’s reviewers must approve every agent pull request, including typo fixes in documentation, and approvals now take days. What should the team change?