Concept
Agents and accountable people
Updated
On this page
Zof treats a change as an agent's when a bot or app account opened it or pushed to it. An agent's change can merge on its own only within the grant your policy gives it, and only when a person is accountable for it. Otherwise an approver for the change's owner takes it over by approving it.
Who counts as an agent?
An agent is a GitHub bot or App account that opens or pushes changes on its own. GitHub marks these accounts, and their logins end in [bot].
Some machines use an ordinary user account, such as a deploy robot with a personal token. An admin can mark such an account as an automation account in the Agents tab of Release policies. Zof then treats it as an agent too.
A person using AI tools isn't an agent. Their changes follow your normal rules.
The testing agents that run your tests on the Run page are something else. See What each test checks.
If any account that opened or pushed to the pull request is an agent, the whole change is an agent's change.
Who is the accountable person?
Every agent change needs a person who answers for it:
| Who opened the pull request | Accountable person |
|---|---|
| A person | That person. |
| An agent | The one person assigned to the pull request on GitHub, if a person who didn't write the change assigned them. |
With no accountable person, the reason is accountable_human_unknown, and the result is Awaiting approval.
What may an agent do on its own?
The Agents tab of Release policies lists each agent's grant. A grant says whether the agent may merge, in which environments (production, staging), and up to which tier. Older deploy grants remain visible, but cannot be newly selected.
| The agent | Reason | Result |
|---|---|---|
| Has no grant | agent_not_granted | Awaiting approval |
| Goes beyond its grant | agent_permission_exceeded. Verification names what it exceeds: action, environment or tier. The check on GitHub says only "The agent author exceeds its grant." | Awaiting approval |
| Stays within its grant, with an accountable person | none | Your normal rules decide |
How does a person take a change over?
A person takes an agent's change over by approving the pull request on GitHub. Their review counts when:
- they're listed in Release approvers, by name or through a team, for an owner of the change's most critical services;
- they can write to the repository;
- they didn't write or push to the change, and aren't the person the agent acts for;
- they approved the latest commit, after Verification reported on it.
That approval lifts the agent reasons for the merge. The change still has to meet every other rule. If Zof knows no owner for the change, nobody can take it over by approving. A grant in the Agents tab can still cover an agent's change that has an accountable person.
What this means for you
- To grant an agent or mark an automation account, see Change your release policy.
- To take over an agent's change, see Approve a change.
- To choose who may approve for each owner, see Choose who can approve.