AI automation can handle background work that requires judgment, such as upgrading dependencies and opening a pull request.
2
Agent permissions, network access, writable outputs, and secrets need deterministic controls outside the prompt.
3
Software development needs shared spaces for plans, discussions, and decisions that are not present in the code.
Summary
Idan Gazit presents two GitHub Next prototypes built around a shift from individual productivity to group productivity. Agentic Workflows turns a short natural-language request into a Markdown playbook that can inspect releases, read upgrade guidance, change code, run builds, and open a pull request. Its front matter limits permissions, tools, network access, and writable outputs. Gazit argues that prompts cannot provide reliable security controls because prompt injection can override them. ACE explores software development in cloud microVMs, where teammates and agents share conversations, branches, previews, and editable plans. The shared conversation gives the agent access to decisions that are absent from the code, including infrastructure constraints and team preferences. Gazit ends by arguing that current AI tools focus on typing, which accounts for about 5% of developer work in a study of around 100 developers over thousands of hours. The harder problem is helping teams decide what to build and how to change it.
AI automation should give teams more time for product work
Gazit says AI began with personal productivity, completing what one person types and fetching information through agents. The larger value comes from helping groups of people do more. He frames this through automation and collaboration. Traditional software automation handled fixed rules, such as checking for semicolons. AI can now automate tasks that require basic judgment and intelligence. That can free people to spend more time on craft, product decisions, and features. He also warns that faster work makes small misunderstandings more expensive, because wasted effort now consumes both time and tokens.
Agentic Workflows turns a short request into a Markdown playbook
Gazit uses his Astro website as an example. Astro releases frequently, and dependency upgrades often require code changes. He asked Copilot, in roughly the style of a Slack message to a junior developer, to check for releases, read the changelog and documentation, plan the upgrade, and create a pull request. Copilot expanded that request into a Markdown workflow. The resulting playbook identified the dependencies, reviewed upgrade guidance, applied changes, and created the pull request. Gazit describes the Markdown as the source code, while the generated YAML Actions file is a compiled artifact.
Prompts cannot be the security boundary for agents
The workflow puts its controls in YAML front matter. Gazit says a prompt such as 'do not buy Bitcoin for me' is not a guardrail, because another prompt can inject instructions that change the agent's behavior. The workflow instead declares permissions, available tools, allowed network destinations, and safe outputs deterministically. His example limits network access to places such as the NPM ecosystem, GitHub, and the Astro documentation. It also allows the agent to create only one pull request. The agent is explicitly allowed to do nothing, since unwanted automation can create noise or deny service to its owner.
An upgrade agent can handle code changes while reporting human work
Gazit shows the workflow running against his real website. It reads release notes, produces a tailored summary, checks for breaking changes, and verifies the project by running the build. A preview deployment lets him confirm that the site still works. The more demanding example upgrades Astro from version 5 to version 7, covering two major releases. The agent finds broken code, updates it, verifies the build, and identifies manual steps that Gazit still needs to complete. He can change the automation by editing its English Markdown rather than its generated Actions YAML.
Agent security needs multiple layers and no direct access to secrets
Gazit gives four principles for agent security, beginning with defense in depth. He says agents should never be trusted with secrets. If an agent can see a secret, that secret should be treated as compromised because an injection could cause the agent to reveal it elsewhere. In Agentic Workflows, secrets remain outside the agent's jail. The agent must ask an external controller to use one when calling a service. Gazit also calls for staging and reviewing all writes, plus logging everything so actions can be audited. He cites Home Assistant's workflow for classifying submitted issues by tracing Python stack traces.
ACE puts teammates, agents, and development sessions in one shared surface
ACE looks similar to Slack, but each session runs in a cloud microVM rather than on Gazit's machine. A session is a repository branch checked out in the cloud, where people can talk, install dependencies, run a development server, and open a preview. The shared chat preserves the discussion that led to a decision. Gazit can tell ACE to act on that conversation instead of repeating the instructions. He says AI can also extract the final decision from a conversation that moved through several proposals and edge cases.
Plans become shared documents that an agent can make true
For a more complicated feature, Gazit asks ACE to create a plan for selectable time frames in an application. The plan is a Markdown document that teammates can edit together. One teammate can suggest adding an all-time option, while Gazit removes another option, and they can then tell ACE to implement the revised plan. Gazit expects more development decisions to be captured in documents in a docs folder. In that model, changing an application starts with editing a document and asking AI to make the document true.
The next interface must support the 95% of development that is not typing
Gazit closes with a longitudinal study of around 100 developers observed over thousands of hours. It found that hands-on-keyboard typing accounts for about 5% of the work. He says AI tools have mainly helped with that 5% so far. The remaining work includes understanding how a system works, deciding what to change, hearing what teammates think, and scaling those decisions across a codebase. ACE and Agentic Workflows are experiments in supporting those activities through shared conversations, plans, background automation, and agents that can ask people for clarification or help.
"If we're going to be not supervising agents doing things, then we're going to need much stronger guardrails around what they're allowed to do, what they're allowed to read, what they're allowed to write."07:17
Who should watch
You are building background agents that can change repositories or open pull requests and need a concrete permissions model.
Your team is trying to share decisions with coding agents without repeating discussions as separate prompts.
You want to think beyond code completion and support planning, review, coordination, and other development work.
