# Private-repository access decision record

**Rethinking Agents · Template v0.3 · 2026-09-22**

Use with the [worked recipe](https://rethinkingagents.com/resources/agent-access-review). Complete locally; do not send private architecture, source or credentials to Rethinking Agents. “Unknown” is an acceptable answer. Blank fields do not count as passed checks.

## Task and scope

- Record ID / review date / reviewer role:
- Useful task and explicit completion criteria:
- Client, connector, model and runtime versions:
- Required repositories, toolchain and input sources:
- Untrusted inputs:
- Approved model-service recipient and data handling decision:
- Intended output, receiving audience and visibility:
- Explicitly unnecessary resources/operations:
- Prior context, enabled tools, credential references and logging/upload paths:
- Scope-change owner and review trigger:
- If a tool fails: permitted fallbacks, attempt/time limit, stopping condition and enforcing component:

## Boundary evidence

Evidence labels: **requested / documented / configured / observed / unknown**. Attach a dated source or redacted observation reference to every claim. A configuration screenshot is not a behavior test.

| Resource + operation + route | Required and why | Principal / credential reference | Enforcing component | Evidence state + reference + version | Gap / next action / owner |
|---|---|---|---|---|---|
| Checkout read | | | | Unknown | |
| Unrelated resource read | | | | Unknown | |
| Workspace/scratch write | | | | Unknown | |
| Compiler/dependency access | | | | Unknown | |
| Connector / alternate tool | | | | Unknown | |
| External output / logging | | | | Unknown | |

## Release decision

- Exact artifact/version to review, including all transferred content and metadata:
- Destination, operation and visibility:
- Who authorizes release, and where review happens before disclosure:
- What binds approval to the actual transfer:
- What invalidates approval; what happens after an uncertain/partial transfer:
- Alternate release routes and their controls:

## Check record — do not relabel planned checks as results

| Check / attempt ID | Environment/config revision | Expected outcome | Actual outcome (default NOT RUN) | Evidence reference | Confounder / follow-up |
|---|---|---|---|---|---|
| Benign task/reference | | | NOT RUN | | |
| Benign task/restricted | | | NOT RUN | | |
| Unnecessary read | | | NOT RUN | | |
| Unnecessary write | | | NOT RUN | | |
| Alternate route | | | NOT RUN | | |
| External effect + positive control | | | NOT RUN | | |
| Changed release object | | | NOT RUN | | |

- Completion criteria met / unintended effects:
- Attempts and excluded runs, with reasons:
- Elapsed time / charges / intervention count / human review minutes:
- Which legitimate task fails under these restrictions:

## Outcome

- Decision: **UNDECIDED** → enable with constraints / defer pending evidence / keep manual.
- Evidence supporting that decision:
- Residual uncertainty and who accepts it:
- Next action, owner and review date:
- Refresh triggers:

Optional public-safe feedback: describe a boundary this record helped identify or a question it could not answer. A download or completed form alone does not establish reduced risk.

If an action has already timed out, use the [uncertain-action investigation record](https://rethinkingagents.com/resources/uncertain-agent-action). A review of configured access does not establish what happened at the receiving system.