agentic-sdlc-controls
Compare original and translation side by side
🇺🇸
Original
English🇨🇳
Translation
ChineseAgentic SDLC Controls
智能代理驱动的SDLC管控
An agent in your pipeline acts with your credentials, at machine speed, without getting tired of a repetitive task. That is the point of it, and it is also the threat model. Review the boundary, not the agent's intentions.
Applies to any coding agent with write access — Claude Code, Codex, Cursor, OpenCode, or a CI job that calls a model. Nothing here depends on which one.
流水线中的代理会使用你的凭证执行操作，速度快且不会因重复任务感到疲惫。这正是它的价值所在，但同时也是威胁模型的核心。我们需要审查的是边界，而非代理的意图。
本内容适用于任何拥有写入权限的编码代理——Claude Code、Codex、Cursor、OpenCode，或是调用模型的CI任务。内容不依赖于具体使用哪一款代理。
1. Establish What the Agent Can Actually Reach
1. 明确代理的实际可访问范围
Inventory before opinion. For each agent or automation:
- Identity: whose credentials does it run as? A named service identity, or a human's personal token?
- Repositories: read, write, or admin? Can it push to a default branch, or only open a PR?
- Environments: can it reach staging? production? a customer's data?
- Secrets: which values are in its environment at runtime, and which of those does its task actually require?
- Network: can it make arbitrary outbound calls, or is egress restricted?
Write this down as a table. The common finding is not a subtle misconfiguration — it is that nobody had the list.
先梳理清单，再发表观点。针对每个代理或自动化工具：
- 身份标识：它使用谁的凭证运行？是命名服务身份，还是个人令牌？
- 代码仓库：拥有读取、写入还是管理员权限？能否推送到默认分支，还是仅能发起PR？
- 环境：能否访问预发布环境？生产环境？客户数据？
- 密钥：运行时环境中包含哪些密钥值，其中哪些是任务实际需要的？
- 网络：能否发起任意出站请求，还是出站流量受到限制？
将这些信息整理成表格。常见的问题并非细微的配置错误——而是根本没人整理过这份清单。
2. Separate Reversible from Irreversible
2. 区分可逆操作与不可逆操作
Classify every action the agent can take:
| Class | Examples | Control |
|---|---|---|
| Reversible, contained | edit a file, run tests, open a PR | let it run |
| Reversible, visible | push a branch, comment on an issue | let it run, log it |
| Slow to reverse | merge to main, publish a package, migrate a schema | human approval gate |
| Irreversible | delete data, rotate production credentials, send external mail, spend money | never delegated |
The line to defend is the third row. Reversibility is the property that matters, not how risky the action sounds.
对代理可执行的每一项操作进行分类：
| 类别 | 示例 | 管控措施 |
|---|---|---|
| 可逆、受控 | 编辑文件、运行测试、发起PR | 允许执行 |
| 可逆、可见 | 推送分支、在议题下评论 | 允许执行并记录日志 |
| 恢复缓慢 | 合并到主分支、发布包、迁移数据库 schema | 需人工审批关卡 |
| 不可逆 | 删除数据、轮换生产环境凭证、发送外部邮件、产生费用 | 绝不可委托代理执行 |
需要重点防护的是第三类操作。关键属性是可逆性，而非操作听起来的风险程度。
3. Enforce Gates in the Runtime, Not the Prompt
3. 在运行时强制设置关卡，而非仅通过提示指令
An instruction not to do something is a preference. A control the agent cannot bypass is a boundary.
- Prefer mechanisms the agent executes inside: pre-action hooks, permission allow/deny lists, managed settings a local config cannot override
- Verify the gate holds when the agent is run non-interactively — many approval prompts silently pass in CI
- Check the deny path is tested. An untested gate is a gate nobody knows is open
- Confirm an agent cannot edit the file that constrains it
Ask directly: if the agent were to attempt the worst action in its scope, what stops it, and has anyone watched that work?
“不要执行某操作”的指令只是一种偏好。而代理无法绕过的管控措施才是边界。
- 优先采用代理内部执行的机制：操作前钩子、权限允许/拒绝列表、本地配置无法覆盖的托管设置
- 验证代理在非交互式运行时关卡是否生效——许多审批提示在CI环境中会自动通过
- 检查拒绝路径是否经过测试。未测试的关卡相当于无人知晓其处于开放状态的关卡
- 确认代理无法编辑限制其操作的配置文件
直接问自己：如果代理尝试执行其权限范围内最恶劣的操作，是什么阻止了它？有没有人亲眼验证过这个阻止机制有效？
4. Scope Credentials to the Task and the Blast Radius
4. 凭证范围匹配任务需求，控制影响范围
- One identity per agent purpose; no shared human tokens
- Short-lived credentials over long-lived keys; expiry measured in the length of a task
- Environment-tiered autonomy: broad in a sandbox, narrow in staging, minimal in production
- Read-only by default where the task allows it — many review and triage agents never need write
- Isolate execution so a compromised or confused agent cannot reach beyond its workspace
- 每个代理用途对应一个独立身份；不共享个人令牌
- 使用短期凭证而非长期密钥；有效期以任务时长为单位
- 按环境分层设置自主性：沙箱环境中权限宽泛，预发布环境中权限狭窄，生产环境中权限最小化
- 在任务允许的情况下默认设置为只读——许多审查和分类代理根本不需要写入权限
- 隔离执行环境，确保被攻陷或出现异常的代理无法访问其工作区之外的资源
5. Treat Agent Input as Untrusted
5. 将代理输入视为不可信内容
The agent reads issues, PR descriptions, dependency READMEs, web pages and tool output. Any of those can carry instructions.
- Content fetched during a task must not be able to escalate what the task may do
- Check whether the agent's tool results feed back into privileged actions without a gate
- Test with a benign injected instruction in a source the agent reads, and observe whether it acts on it
代理会读取议题、PR描述、依赖项README、网页及工具输出。这些内容都可能携带指令。
- 任务执行期间获取的内容不得能提升任务的权限
- 检查代理的工具结果是否会在无关卡的情况下触发特权操作
- 在代理读取的来源中注入良性测试指令，观察其是否会执行该指令
6. Make the Trail Reconstructable
6. 确保操作轨迹可追溯
For any change an agent produced, an auditor or an incident responder needs to answer: what was asked, what was produced, who approved it, and against which configuration.
- Prompts, plans and specs version-controlled alongside the diff
- Agent configuration (permissions, hooks, model, skill set) captured at the time of the change, not read from HEAD afterwards
- Approvals recorded as events, not as a person's memory of clicking a button
If this is thin, pair with the skill, which covers turning it into audit evidence.
ai-change-evidence对于代理产生的任何变更，审计人员或事件响应人员需要能够回答：请求内容是什么？生成了什么内容？谁批准的？基于什么配置？
- 提示词、计划和规格说明与代码差异一同纳入版本控制
- 代理配置（权限、钩子、模型、技能集）需在变更发生时捕获，而非事后从HEAD读取
- 审批记录为事件，而非依赖于某人对点击按钮的记忆
如果这方面的记录不完善，可以搭配使用技能，该技能涵盖将记录转换为审计证据的方法。
ai-change-evidenceScope and Rules of Engagement
适用范围与操作规则
Review only pipelines you own or are authorized in writing to assess. Testing a gate means attempting an action the control should stop — do that in a sandbox or a scheduled window, with the owner's agreement, never against production on your own initiative. Injection testing uses inert markers; do not plant anything that would cause harm if the control fails.
仅审查你拥有权限或经书面授权评估的流水线。测试关卡意味着尝试执行管控措施应阻止的操作——需在沙箱环境或预定窗口期内进行，并获得所有者同意，绝不可擅自针对生产环境测试。注入测试需使用惰性标记；若管控措施失效，不得植入任何会造成危害的内容。
Output
输出结果
Report per finding: what the agent can reach, which control is missing or unenforced, the concrete sequence that would exercise it, and the smallest change that closes it. Separate "an agent can do this today" from "this would be better practice". Name the owner for each gap; a control with no owner is not a control.
针对每个问题点报告：代理可访问的范围、缺失或未执行的管控措施、触发该问题的具体操作序列，以及修复该问题的最小变更。区分“代理当前可执行此操作”与“此为更佳实践”。为每个漏洞指定负责人；无负责人的管控措施形同虚设。