Every agent · DevOps and operations agents · various

AI steps in CI (GitHub Actions, GitLab Duo)

Q: What can AI steps in CI (GitHub Actions, GitLab Duo) act on?

Executes autonomously. AI review, fix and generation steps running unattended inside CI with the workflow token.

Q: Is a human in the loop with AI steps in CI (GitHub Actions, GitLab Duo), and does data leave the tenant?

Human in the loop by default: no. Data leaves the tenant by default: configurable. It executes on its own, so it needs the controls of an account that acts: a log you can read, a scope in writing, and a person who can switch it off. Whether data leaves your tenant depends on how it is deployed.

AI review, fix and generation steps running unattended inside CI with the workflow token.

executes autonomously

acts on

human in the loop by default

configurable

data leaves the tenant by default

The repository, secrets and deploy targets the workflow can reach

reaches by default

What that means for the register

It executes on its own, so it needs the controls of an account that acts: a log you can read, a scope in writing, and a person who can switch it off. Whether data leaves your tenant depends on how it is deployed. Pasted with only its name it lands as control until an owner is named.

This week

List workflows that call a model and the secrets they can read.

What holding it is evidence for

Requirement text and artefacts from a human-verified corpus licensed to Agent Register.

Agents that execute without approval ISO 42001 A.6.2.6 · ISO 42001 A.9.4 · ISO 42001 A.6.2.8 · EU AI Act Art.14 · EU AI Act Art.26 · EU AI Act Art.12

ISO 42001 A.6.2.6 AI system operation and monitoring

AI systems shall be operated and monitored according to organizational and operational requirements throughout their lifetime. Operational guidance shall be available to operators.

Evidence an auditor accepts: Operations runbooks; Monitoring dashboards; Incident logs

ISO 42001 A.9.4 Intended use of the AI system

The organization shall ensure that the AI system is used according to the intended uses of the AI system and its accompanying documentation.

Evidence an auditor accepts: Intended use statements; Use case approval records; Monitoring of use

ISO 42001 A.6.2.8 AI system event logging

Event logs shall be generated and recorded during AI system operations to enable monitoring, accountability, and incident investigation.

Evidence an auditor accepts: Logging standards; Log samples; Log retention policy

EU AI Act Art.14 Human oversight

High-risk AI systems shall be designed and developed in such a way that they can be effectively overseen by natural persons during the period in which they are in use. Oversight measures shall enable persons to understand the relevant capacities and limitations and monitor operation, remain aware of...

Evidence an auditor accepts: Human-oversight design (UI, controls, alerts); Oversight-personnel training and authority

EU AI Act Art.26 Obligations of deployers of high-risk AI systems

Deployers shall use high-risk AI systems in accordance with the IFU; assign human oversight to appropriately competent natural persons; ensure input data is relevant and sufficiently representative; monitor operation and inform the provider of risks/incidents; retain automatically generated logs for...

Evidence an auditor accepts: Deployer monitoring records; Logs retained at least 6 months; DPIA where applicable

EU AI Act Art.12 Record-keeping (logs)

High-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system, ensuring a level of traceability appropriate to the intended purpose; logging capabilities for biometric remote-identification AI systems include the period of each use, the ref...

Evidence an auditor accepts: Logging capability design evidence; Log-retention policy aligned with the intended purpose

No human in the loop by default ISO 42001 A.6.2.6 · ISO 42001 A.3.3 · ISO 42001 A.8.3 · EU AI Act Art.14 · EU AI Act Art.26

ISO 42001 A.6.2.6 AI system operation and monitoring

AI systems shall be operated and monitored according to organizational and operational requirements throughout their lifetime. Operational guidance shall be available to operators.

Evidence an auditor accepts: Operations runbooks; Monitoring dashboards; Incident logs

ISO 42001 A.3.3 Reporting of concerns

A process shall be established to enable reporting of concerns about AI systems' development, deployment, or use.

Evidence an auditor accepts: Concern reporting procedure; Whistleblower channel evidence; Concern register

ISO 42001 A.8.3 External reporting

The organization shall provide mechanisms for external interested parties to report concerns or impacts.

Evidence an auditor accepts: External reporting channels; Concern register; Public-facing contact (email, form)

EU AI Act Art.14 Human oversight

Evidence an auditor accepts: Human-oversight design (UI, controls, alerts); Oversight-personnel training and authority

EU AI Act Art.26 Obligations of deployers of high-risk AI systems

Evidence an auditor accepts: Deployer monitoring records; Logs retained at least 6 months; DPIA where applicable

Do this for every tool your teams use

Paste the list and get this classification for every entry at once, with the owner column, the findings per department, and the controls the register is evidence for. Ten entries free, no account.

Build my agent register

Harness AI · Autonomous SDR agents