Build a Path Deny List Before Your First Agent PR

Description and use

Create a local deny list and a pre‑commit script to block agents from editing critical files in the first PR.

Problem

Agents can unintentionally modify critical files (secrets, lockfiles, CI configs) in a first PR, causing merge risks and security leaks.

Outcome

The workflow prevents accidental agent edits to critical paths by enforcing a local deny list and pre-commit check, reducing merge risk and secret leakage.

Workflow

• Clone repo and inspect tree
• Run find to list dangerous files
• Create .agent-untouchable with patterns
• Copy deny file to home for backup
• Write check-untouchable.sh to compare staged files against deny list
• Make script executable
• Optionally add pre-commit hook to run checker
• Test checker by staging a frozen file and verifying failure

Evidence

Agents will chase a green local run. They do not share your merge risk.

Source

Frozen paths never enter the agent context window.

Source