A few weeks ago an AI agent merged a change into the branch that deploys our website to production. Our own rule said no agent should be able to do that. The system recorded no violation: as far as the repository knew, one of the partners had merged the change.
The agent didn't get around anything. It was working with a partner's personal credential, and it carried out an ambiguous instruction with permissions it should never have had.
The review turned up three things. The branch was protected, but the protection checks the role, and the partner owned the project. The sign-off we took for granted before every merge was never a technical control, only an agreement between us. And the history had stopped being useful: changes from two agents and one person all showed the same author.
We decided every agent gets its own identity, with a role that lets it propose changes but not merge them. We tested it by authenticating as the agent, not by reading the documentation: creating a branch and proposing a change works; merging to production is refused.
The cost is that every change an agent makes now waits for a person to close it. And since our plan doesn't offer required approvals, the only real control is that the agent never reaches a role that can merge.