GitHub
Issues, comments, commits, pull requests, reviews and gists — in your account, under your name.
You install the OutLayer app on the repositories you choose; that is the outer fence. Your policy narrows it: which actions, branches and paths, how many writes a day, and whether it may ever merge.
Any write can wait for you — merging, reviewing, committing, down to starring. Tick it under “Ask me before” in the policy, and the agent’s request is checked against your rules and left in your inbox with every value it will use. Nothing is written until you approve it with your wallet, and then exactly what you were shown; a merge or a review is bound to the commit you saw. If you reject it, your reason goes back to the agent. How asking first works →
The owner’s policy
Stored as GITHUB_POLICY, checked inside the enclave before any request leaves. With nothing stored: nothing is allowed yet — the agent can only ask for the connection’s status.
Where?
reposRepositoriesa list- owner/name, or owner/* for every repository of an account. This narrows what you already chose on GitHub when installing the app; it cannot add a repository the app was not installed on. None: nothing that names a repository will run. Write "any" for every repository the app reaches.
branchesBranches it may write toa list- Where files may be written and pull requests opened from. A pattern such as agent/* never reaches a repository’s default branch — to allow writing to main, name it exactly. None: no file is written and no pull request opened. agent/* is the usual choice.
pathsPaths it may writea list- Patterns for the files it may create or change, e.g. docs/*. A * matches anything, slashes included. The .github/ directory is never written, whatever is here. Any path on the branches above — except .github/, which is never written.
How much?
max_writes_per_dayWrites a daya number, writes, all kinds together- Every issue, comment, commit, review and gist counts as one. Counted per calling agent, in UTC days. A write GitHub refused does not count. Not set: nothing is written at all. Reading is not limited by this.
Off unless you say so
allow_mergeMerge pull requestson or off- A merge puts the agent’s work into a branch nobody re-read. GitHub would let it; only this switch stops it. Off: the agent opens pull requests and you merge them.
allow_approveApprove pull requests in your nameon or off- An approval under your name can satisfy a branch protection rule. Without this a review can still comment or request changes. Off: a review comments or requests changes, and never approves.
allow_public_gistsPublic gistson or off- A public gist is readable by anyone and indexed by search engines, and cannot be made secret again. Off: every gist the agent creates is secret.
How are its words told from yours?
markerLine added to what it poststext- Everything the agent posts appears under YOUR name. This line is added to each issue, comment and review so a reader can tell it was not you. The default line: “— posted by an AI agent via OutLayer”.
What may it do?
actionsActionsa set of choices- Each is one operation of the connector. The agent can run only what is ticked; a new operation added later is NOT included until you tick it. Nothing ticked: the agent cannot read or write anything.
confirmManual approvala set of choices- A write ticked here is checked against the rules above, then prepared and left in your inbox instead of being made: you see every value it will use, and approving it takes one signature from your wallet — the agent then makes exactly what you were shown. Asking about a write allows it: ticking it here takes it out of auto-approve, never out of what is allowed. Nothing ticked: the agent makes every write it is allowed without asking.
Auto-approve: the agent runs it within the limits below. Manual approval: it is prepared and waits in your inbox; your yes runs it. Neither: it does not run. A group’s name turns the whole group on or off.
Operations
Every call names one in operation; the other fields are the parameters listed under it.
Reading the deployed version…