[FAQ] Add: How agent actions are constrained (commenting, PRs, files, external tools)

[chrizbo]

Adds a new FAQ entry under the Guardrails section directly answering how gh-aw constrains agent actions — covering the read-only default, safe outputs for writes, and the Agent Workflow Firewall for external calls.

This consolidates information spread across several existing entries into a single, directly-addressable question that users commonly ask.

Change type: New FAQ entry (no existing entry covers this exact question)

Source issue: github/agentic-workflows#528

Generated by Feedback Question Answerer · ● 673.9K · ◷

[github-actions]

❌ Smoke Project encountered failures. Check the logs for details.

[github-actions]

📰 DEVELOPING STORY: Smoke Copilot ARM64 reports was cancelled. Our correspondents are investigating the incident...

[github-actions]

❌ Smoke Multi PR failed to create multiple PRs. Check the logs.

[github-actions]

❌ Smoke Temporary ID encountered failures. Check the logs for details.

[pelikhan]

@copilot simplify example, mention agentic threat detection

[Copilot]

Done in c9910db. Simplified the safe-outputs example to a single minimal operation, simplified the network allowlist example, and added threat detection as a fourth defense-in-depth layer (with a link to the threat detection reference).

[github-actions]

✅ smoke-ci: safeoutputs CLI comment + comment-memory run (25237258705)

Generated by Smoke CI for issue #29642 · ◷

[github-actions]

Comment Memory

CI lights the path
Green checks bloom at dawn
Quiet bots still sing

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

Generated by Smoke CI for issue #29642 · ◷

[Copilot]

Pull request overview

Adds a new Guardrails FAQ entry explaining how gh-aw constrains agent actions across GitHub writes and external network access.

Changes:

• Adds a new FAQ question covering default read-only behavior, safe outputs, threat detection, and network controls.
• Includes short YAML examples for enabling safe outputs and network access.
• Links the new entry to existing FAQ/reference pages about sanitization, threat detection, sandboxing, and approval gates.

Show a summary per file

File	Description
docs/src/content/docs/reference/faq.md	Adds a consolidated Guardrails FAQ entry describing how agent actions are constrained.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (2)

docs/src/content/docs/reference/faq.md:228

• This presents threat detection as an unconditional layer, but the reference allows workflows to opt out with safe-outputs.threat-detection: false. Without that caveat, the new FAQ overstates the guarantees around write-time scanning and may mislead readers into thinking detection always runs.

**3. Threat detection before writes.** [Agentic threat detection](/gh-aw/reference/threat-detection/) runs automatically between the agent job and the safe output jobs. It scans the agent's output for prompt injection attempts, secret leaks, and malicious code patches, blocking the write jobs if a threat is detected.

docs/src/content/docs/reference/faq.md:235

• The network section is inaccurate: the default is not "all outbound network access blocked." The network reference says that omitting network: defaults to network: defaults, which still allows basic infrastructure domains. This answer currently overstates the default restriction for external calls.

**4. Network allowlist for external calls.** The [Agent Workflow Firewall](/gh-aw/reference/sandbox/) blocks all outbound network access by default. You must explicitly allow each domain an agent may reach:

```yaml wrap
network:
  allowed:
    - defaults

• Files reviewed: 1/1 changed files
• Comments generated: 1