You can just make the tool calls restricted/scoped to whatever the calling account has access to (or in this case the repo)
That way even if the LLM broke out of the system prompt the worst case would be similar to a 404 or 401.
Why are we giving these processes super user access? No reason to have the executing loop/chat turns/tool calls be scoped to anything but the narrowest permissions.
If the agent truly needs data/permutations across different accounts or repos, treat the tool calls like any other API that needs to do that kind of work pre-LLM
That way even if the LLM broke out of the system prompt the worst case would be similar to a 404 or 401.
Why are we giving these processes super user access? No reason to have the executing loop/chat turns/tool calls be scoped to anything but the narrowest permissions.
If the agent truly needs data/permutations across different accounts or repos, treat the tool calls like any other API that needs to do that kind of work pre-LLM