NAV stops the agent before a merge
NAV runs coding agents in the cplt sandbox. The agent may commit and push feature branches. Merge, delete, release and push to the default branch are blocked.
Done with Valgfri agentModerate
This is a public report, not advice from Skatteetaten, NAV, Altinn or an accountant. Check figures, deadlines and decisions against the original.
What was done
NAV AI development published the piece on 6 September 2026. The update on 29 September 2026 removed the grant for application_default_credentials.json in this repo's .cplt.toml. The file holds a refresh token for the whole Google account, and the tasks that use it run through fnox, which does not work in the sandbox. Around 700 developers have a GitHub Copilot licence. In March 2026 they asked about 500 how they work with AI coding tools. 163 answered. Twelve use none. Three quarters use two or more. cplt runs, among others, Copilot CLI, OpenCode, Gemini CLI, Claude Code, or a shell. The agent may commit, branch and rebase. gh pr merge, gh repo delete, gh release create and gh workflow run are blocked, along with about sixty other subcommands. git push to the default branch is blocked. A push to a feature branch goes through. Force push is blocked everywhere. The guard is a shim on the PATH. An agent that calls git by absolute path walks past it. They write that branch protection on the server is the real boundary. Policy is read from git HEAD, not from the working tree. A deny section tightens with no approval. A propose section does nothing until the developer runs cplt trust accept, pinned to a hash. They have not caught an agent deleting a repo. Both guards block now. Earlier the gh guard blocked, while the git guard only warned.
How it went
The default is that merge, delete, release and push to the default branch are blocked. They have not caught an agent deleting a repo. They do not say no feature branch has been wrong.
Worth knowing
Check the original. The PATH shim is a filter they themselves call best effort. Linux without bubblewrap leaves some paths writable. There is no Windows backend. WSL2 works as Linux. The survey is 163 answers, not all of the about 500.
How to do it
- Let the agent commit on a feature branch in [repo].
- Let the guard stop merge, delete, release and push to [default-branch].
- Accept new permissions yourself with cplt trust accept, after you have read the file.
Try it with Valgfri agent
In [repo], commit on a feature branch. Do not merge, do not delete, do not create a release, and do not push to [default-branch]. Do not deploy until I say yes.
Replace text in brackets with your own.
Done when. The work is on a feature branch, and the default branch has not been pushed to unless you said yes.
Safety rule. The agent does not merge, does not delete, and does not create a release. You accept new permissions yourself.
Read the original
Read the original · NAV AI development ·