Require approval for GitHub writes

[kevinjqliu]

I would like agents to ask for explicit permission before making any visible GitHub changes, to reduce noise.

This PR updates AGENTS.md to require action-specific approval before writing to GitHub.

When I asked copilot to create this PR, heres what I got (Good bot):

This wont catch all the cases, and might not be respected by all agents, but I think its a step in the right direction

[Copilot]

🟢 Approval recommended

No unresolved review comments remain.

Pull request overview

Updates AGENTS.md to require approval before making GitHub changes.

Changes:

• Treats GitHub as read-only by default.
• Requires explicit, action-specific approval for writes.
• Requires showing proposed targets and content before writing.

File summaries

File	Description
AGENTS.md	Adds GitHub write approval requirements.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[rambleraptor]

I don't see the harm in adding this to AGENTS.md but I think this would better belong somewhere in your setup locally.

I don't see this cutting down on the repository's LLM-generated comments.

[nssalian]

An agent can bypass this. Something like stop hooks have helped if some git / other commands are attempted to being run. So I'm not sure of the value of adding it here versus having users keep their local setup guardrails.

[kevinjqliu]

I'm actually not sure if this will work as intended. The idea is to stop agents from doing this by default. For example, when I started using Copilot, it created an issue for me even though I was just asking it some questions.

Let's give this a try