Roles and agents on a flow
Separate human principals from agent stages, and assign only resolved roles before compile.
Last updated September 27, 2026
Roles
A role on the Blueprint is a principal that compile can resolve. Governance settings name who may act. Designer, reviewer, and operator seats in the Canon org are not a substitute for those principals.
Allowed principals are real people or the Canon GitHub App. @code-owner and other placeholders are not principals. Empty production reviewers block an enforced package.
Agents
An agent stage runs in GitHub Actions after Start Run. Designer does not execute the agent. The compiled package ships the agent spec with the graph. Tools and connections for that agent must already be declared. See Connections, tools, and agent authority.
If the agent uses GitHub Copilot CLI, the GitHub org must enable Copilot and Copilot CLI / coding-agent policy for the workflow actor. The failure text is Access denied by policy settings.
What compile checks
- every human gate has a resolved reviewer
- every agent stage has declared connections and actions
- no placeholder remains in production reviewer lists
Fix roles on the Blueprint. Do not patch generated agent files to change who may act.