Agent Security Is Moving From Policy To Runtime

The qualifying primary signal came from GitHub Changelog: CodeQL 2.26.0 adds Kotlin 2.4.0 support and AI prompt injection detection. CodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.0, which adds support for Kotlin 2.4.0,… It was published inside the briefing window and passed the source-quality, source-cap, topic-cooldown, and coverage gates. The interpretation below is a product decision to test, not a claim that the source alone proves the outcome.

A written rule cannot contain a workflow after credentials, network access, and side effects have already been granted. Trust has to be expressed in the execution environment and the evidence it produces.

Map one agent workflow from trigger to side effect. Remove standing credentials, scope tools to the job, require approval before irreversible actions, and retain a run log. Verify both the successful path and the denied path before expanding access.

List every system one production agent can touch, then remove one permission. If the workflow cannot recover or ask cleanly for escalation, its trust boundary is still implicit.