Review pack

Summary

Pack

HELIX-REV-2026-08-12

Agents

6

Grants

38

Findings

8

Open

6

Decided

2

Sample recertification pack. Two findings ship with reviewer decisions so this export is never blank. Decisions made in the browser overlay the seeded decisions.

Decisions in this pack

• R02 · Agent has no ownerassignedhigh

  No owner on a production agent. Assign Jonah Hale to name an owner and recertify web-fetch grants within 14 days.

  Jonah Hale · expires 2026-08-26

• R07 · Google admin scopes have no expiryacceptedhigh

  People Ops needs directory admin during the current onboarding wave. Accept for 90 days, then drop admin scopes if the agent is only scheduling and announcing.

  People Ops · expires 2026-11-10

Open findings

• R01 · Wildcard tools on web-fetch-mcp · Sales Research Agentcritical
• R03 · Customer PII combined with outbound email · Support Copilothigh
• R04 · Granted repo.write is unused · Code Review Agentmedium
• R05 · Secrets access plus outbound webhook · Infra Operatorcritical
• R06 · Production label with staging Stripe keys · Finance Close Agenthigh
• R08 · Shared DevOps bot identity · Infra Operatorhigh

Remediation checklist

• Replace web-fetch-mcp wildcard with an explicit tool allow-listUnassigned · due 2026-08-26
• Name an owner for Sales Research AgentJonah Hale · due 2026-08-26
• Separate PII read from gmail.send on Support CopilotMaya Chen · due 2026-09-09
• Drop unused GitHub repo write scope on Code Review AgentPlatform · due 2026-09-09
• Remove secrets.read and pin or disable webhook.dispatchDevOps shared · due 2026-08-19
• Correct Finance Close Agent environment or Stripe keyFinance · due 2026-08-26
• Set 90-day expiry on Google admin scopesPeople Ops · due 2026-11-10
• Replace shared DevOps bot with a named identityDevOps shared · due 2026-09-02