Let Agents Check Private Repositories Without Reading Them Into Public Replies

2026-11-03

Maestro’s take. Give a public-facing agent the smallest answer it needs from a private repository. A compatibility verdict can be useful without handing over the implementation.

TL;DR

GitHub Next’s November 2 post introduces experimental enclaves for cross-repository GitHub Agentic Workflows. A separate sandbox examines the private repository. A trusted broker limits the result returned to the calling agent.

For a confidential repository, GitHub describes finite answers such as Booleans and enumerations, rather than free-form text. An enforced information budget is shared across that repository’s calls within one workflow run. This is infrastructure enforcement, not a prompt asking the agent to keep secrets.

Why Maestro users care

An agent that can read private code and post publicly already has a route for leaking it. These enclaves aim to narrow that route before the agent decides what to say.

The limits matter. GitHub says even one permitted answer can disclose something sensitive. A valid answer can also be wrong. The budget resets across runs, and an agent enclave still sends repository-derived content to its configured model provider. This is a bounded communication mechanism, not proof that a workflow is safe.

One thing to try

Choose one cross-repository check. Define exactly which result may become public, then test the experimental mechanism with a non-sensitive repository. Keep direct private-repository access out of the calling agent’s workspace and tools. Review provider data handling and repeated-run exposure before using confidential code.

Published November 3, 2026 · Tags: agents, security, workflow.