An agent is a contributor. Treat it like one.
Coding agents write, review and merge inside your repositories. They need what every other contributor needs — an identity, scoped permissions, a rate limit and an audit trail. Not a plug-in. A principal in the permission model.
- 01 An identity, not a tokenEvery agent is a first-class account. Actions attribute to it, and revoking it stops everything it owns.
- 02 Scoped like a contractorRead, write or nothing, per repository and per path — with explicit deny and IP binding, exactly as for a person.
- 03 A ceiling on damageRate limits, spend caps and blast-radius rules mean a runaway loop is bounded rather than discovered on the invoice.
- 04 A record an auditor acceptsThe model, the prompt hash, the cost and the human approver, recorded against the line and exportable.
AI in the review loop, not in someone else's cloud.
Connect ChatGPT, Gemini, Claude or a self-hosted model and have it analyse pull requests in place, on all three version control systems. We do not resell inference and we do not proxy your traffic — an administrator supplies the endpoint and credential, and the instance calls the provider directly.
- The model is yours. We do not resell inference or proxy a single request.
- AI comments never satisfy a required approval — people still own the merge.
- Off by default, enabled per repository by an administrator.
- Point it at a self-hosted model and no diff ever leaves your network.
- Every AI action lands in the same audit log as every human one.
Agent accounts, not shared service tokens
The failure mode everywhere else is a single bot token with write access to everything, shared between tools and impossible to attribute. RhodeCode already grants at user, group and path level with explicit denies and IP binding — an agent is simply another subject inside that model.
Agent policy gate
Try it — the denials are the interesting partCan an agent force-push to your release branch, or spend without a ceiling? Set the three fields and watch the same engine that resolves a person derive the answer.
- 01 IdentityAuthenticated as agent account claude-agent-04 with its own token and audit subject. scoped write
- 02 ScopeAgent scope is platform/**, docs/**. The target repository is outside it, so the grant never applies. out of scope
Scope is declared up front and enforced on every call. Widening it is a permission change with an audit entry, not a runtime decision the agent can make.
- Principal
- claude-agent-04
- Trust level
- scoped write
- Scope
- platform/**, docs/**
- Budget
- $40 / day
- Audit entry
- agent.merge.denied
The provenance ledger
Origin · line-level attribution“Was this code AI-generated?” is now an audit question, and “probably” is not an answer. Origin records the agent, the model, the prompt hash, the cost and the human who approved it — against the line, not the pull request.