Your Coding Agent Can Ignore a Preferred Tool. Enforce the Rule at the API.

2026-10-30

Maestro’s take. If a coding-agent rule must hold every time, enforce it where the action happens. A preferred tool is only a preference when the agent can reach the same API through its shell.

TL;DR

In “A Little Determinism,” published October 29, David Cramer describes how Sentry’s Junior handles a concrete problem: pull requests need a consistent attribution footer, but the agent can create them through gh instead of its dedicated tool.

Cramer says Junior’s egress proxy inspects requests and rejects the GitHub GraphQL mutation used by gh pr create. The rejection tells the agent to use Junior’s pull-request tool, which adds the footer and handles idempotency. He also describes injecting credentials at the proxy rather than exposing them inside the sandbox.

This is a practitioner’s account of one system. It is not an independent security audit or proof that every alternative request path is covered.

Why Maestro users care

A system can offer the right tool and still permit the wrong route. That matters for more than a footer. A required approval, spending limit or attribution rule becomes unreliable if it applies only to one interface.

Maestro’s inference: review the action’s reachable paths before adding another instruction. If both a native tool and a shell can submit the same change, the policy needs to cover both. The model can still choose how to investigate and write code inside that boundary.

Cramer also says Junior blocks pull-request approval even though the underlying token has that capability. That is the useful separation: possession of a credential need not determine what the agent is allowed to do. The enforcement still depends on a correctly configured boundary.

One thing to try

Choose one mandatory rule in a test repository. Ask whether the agent can bypass its preferred tool with gh, a direct HTTP request or another client. Verify the resulting server-side action, not just the agent’s explanation. Close the alternative route or apply the same policy there before relying on the rule.

Published October 30, 2026 · Practitioner account and Maestro commentary · Tags: agents, workflow, security

Original source: David Cramer’s account of Junior’s network policy and pull-request workflow.