--- title: A GitHub token is not an agent permission model | daily.dev description: Handing a coding agent a GITHUB_TOKEN grants far broader access than the agent's task requires, since the token becomes readable by the model and every tool it... canonical: https://daily.dev/posts/a-github-token-is-not-an-agent-permission-model-lygweb11n twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A GitHub token is not an agent permission model | daily.dev og:description: Handing a coding agent a GITHUB_TOKEN grants far broader access than the agent's task requires, since the token becomes readable by the model and every tool it... og:url: https://daily.dev/posts/a-github-token-is-not-an-agent-permission-model-lygweb11n og:image: https://api.daily.dev/og/posts/lygweb11n.png og:image:alt: A GitHub token is not an agent permission model og:image:width: 1200 og:image:height: 630 og:locale: en --- [](https://daily.dev/dimak)[Radim Höfer@dimak•Aug 2810](https://daily.dev/dimak) # A GitHub token is not an agent permission model [](https://media.daily.dev/image/upload/s--HUzDkcqc--/f%5Fauto/v1787931396/posts/lygweb11n?%5Fa=BAMAMicg0) 15 Impressions1 Repost Comment Bookmark Copy Share your thoughtsPost [](https://daily.dev/dimak) [Radim Höfer](https://daily.dev/dimak) [@dimak](https://daily.dev/dimak) Joined Mar 30\. 2023 10 Founder & CEO @ Stashbase #### Would you recommend this post? Copy link WhatsApp Facebook X New Squad Copy linkShare with your friends ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/a-github-token-is-not-an-agent-permission-model-lygweb11n","headline":"A GitHub token is not an agent permission model","text":"Handing a coding agent a GITHUB_TOKEN grants far broader access than the agent's task requires, since the token becomes readable by the model and every tool it invokes, risking leaks into logs, commits, or unrelated requests. The proposed fix is to separate identity from capability: run agent requests through a local proxy that holds real credentials and injects them only when a request matches allowed host, method, and path rules, while keeping network egress control separate from credential injection. Additional layers like filesystem policies, command denylists, and network sandboxing address risks the proxy alone can't cover. The piece closes by pointing to Stashbase's Agent Proxy as an implementation of this model.","url":"https://daily.dev/posts/a-github-token-is-not-an-agent-permission-model-lygweb11n","datePublished":"2026-08-28T15:36:35.721Z","dateModified":"2026-08-28T15:46:40.623Z","author":{"@type":"Person","name":"Radim Höfer","url":"https://daily.dev/dimak","image":"https://media.daily.dev/image/upload/s--qJKQj4mt--/f_auto/v1787999791/avatars/avatar_BFkEeJcX8FgCbK9Rg6d2p?_a=BAMAMicg0","description":"Founder & CEO @ Stashbase","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":10}},"image":"https://media.daily.dev/image/upload/s--HUzDkcqc--/f_auto/v1787931396/posts/lygweb11n?_a=BAMAMicg0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/bfkeejcx8fgcbk9rg6d2p","name":"Radim Höfer"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Radim Höfer","item":"https://daily.dev/sources/bfkeejcx8fgcbk9rg6d2p"},{"@type":"ListItem","position":3,"name":"A GitHub token is not an agent permission model"}]} ```