# The rule
No agent, human, or bot pushes directly to important branches. All changes land through pull requests with review and passing checks. This is the single highest-leverage repo setting for agent-driven development.
# Steps
1. In the repository settings, protect the main branch and any release branches.
2. Require a pull request before merging, with at least one approving review. For agent-authored changes, that approver should be a human.
3. Require status checks to pass before merging: tests, lint, security scans. An agent PR that breaks the build should not be mergeable by anyone.
4. Turn on dismissal of stale approvals when new commits are pushed, so an approval cannot be reused after the code changed underneath it.
5. Do not exempt administrators or bots from these rules. An exemption is a hole shaped exactly like your automation.
# Checks
- Try pushing to main as a test. It should fail.
- Review the bypass list regularly. Every entry is someone or something that can skip review.