glossary · Running it

Agent git access

definition

Agent git access is the setting that decides whether an AI agent running unattended holds a git key and pushes its own work, or works on a prepared copy while the platform does every fetch and push for it.

in one line: Who pushes the work: the runner, or the agent itself.

in context

Where does agent git access fit?

Who does git with the remote. By default the agent commits and the runner pushes. Full hands the agent the key.

Nonecommit only, runner pushes

Fullthe agent holds the key

Either waynothing left unpushed

Set per environment.

two ways to say it

What is agent git access, in plain words?

Same idea at two depths: the plain version, then what the engine actually does.

An agent with a git key can reach every repository the key reaches. Most work does not need that.

Choose per environment, and see which key the agent would hold before you save.

for engineers

agent_git: none (default) or full. Saving full returns warnings and agent_git_keys.

Under full the key sits outside the working copy, is masked, and is removed when the run ends.

the longer answer

Why does agent git access matter?

An agent that writes code has to get its work back into the repository. The simplest setup gives the agent a git key, but then the agent can reach every repository that key reaches, and a mistaken command touches the remote directly. The opposite setup keeps keys away from the agent and lets the platform move the work, which is safer but means the agent cannot fetch or merge mid-run.

Neither is right for every team. A review branch per task with no agent-held key suits most work. Some flows, such as an agent that must merge the latest base branch before it finishes, need the agent to do git itself.

in convops

How does agent git access work in ConvOps?

In ConvOps, agent git access is set per environment. Under none, the default, the agent commits on the copy ConvOps prepared, holds no git key, and the runner pushes the work to the task branch or a chosen branch when the run ends. Under full, the agent holds the environment's matched key and can fetch, merge and push its own work to the same destinations; the key sits outside the working copy, is masked in output and is removed when the run ends, and the runner still delivers anything left unpushed. Saving full returns a warning that names each key the agent will hold.

questions

What do people ask about agent git access?

Does the agent push its own code?

Only when you choose it. In ConvOps the default is none: the agent commits and the runner pushes when the run ends. Under full the agent holds the environment's matched key and pushes its own work.

What can an agent reach with full git access?

Every repository the environment's matched key reaches; an account key reaches the whole account. Saving full returns a warning naming each key the agent will hold.

What does agent git access connect to?

Unattended executionNobody at the keyboard. People join only at gates.Agent executorWhich agent runs the work, and where.

Environments in ConvOps Unattended execution Security

your next step

Teach it once. Then let it run.

on your ownStart freeConnect your AI tool in one line. Nothing to install.with your teamBook a demoWe show ConvOps on your team's real work.keep readingAutonomous systemAn AI loop that starts itself, follows a process, and leaves a record.