A coding agent that never holds the keys

A coding agent running on a local open-source model edited code in a throwaway container, ran the tests, committed, pushed, and a merge request appeared for human review. The agent never held the repository credential and had no path to the main branch. A second, long-lived agent checked the request and opened the merge request on its behalf.

The challenge

Autonomous coding agents are useful in proportion to what they can touch, and dangerous in the same proportion. The usual compromise hands the agent a scoped token and hopes. I wanted a design where the worker could do everything a developer does up to the point of proposing a change, and could not do the one thing that matters: write to the repository everyone depends on.

Constraints

A local open-weight model served through vLLM on my own hardware, with no frontier API in the loop. A throwaway container, destroyed after the run. Humans review every change.

My approach

Split the job. The worker agent edits, tests and pushes to its own branch. A separate gatekeeper agent, long-lived, checks the worker's request and opens the merge request. The worker never holds the repository credential.

What I built

Coder and gatekeeper personas with distinct tool grants.

A path by which the worker asks the gatekeeper to act on a finished branch.

Difficult decisions

A narrow scripted task for acceptance.

An impressive open-ended demo would have proved less.

The acceptance task was small and exact, so the security property got tested instead of the model's cleverness.

Counting a failing-test run as a success. One run's tests failed. The agent stopped without pushing. That is the correct behaviour and it was scored as a pass.

Results

Acceptance runs on an internal test repository:

Technologies used

Rust · Docker · Redis Streams · Open-weight local models on vLLM · GitLab API

What this demonstrates

Least-privilege design for autonomous coding agents, proven with an honest scope, on a local model.