Handing a security finding to your coding agent

What the prompt carries

Four things, always: the evidence (the file and the lines the finding is grounded on), the rule (the access rule in question, for example that a project update requires an ownership check), the boundary (fix the gate, not the symptom), and the review gate (a human reviews before merge). The prompt is small because the agent's job is small. The finding is a lead, not a decision: a human chooses to act on it, and the agent then investigates the lead and proposes a bounded fix. The patch stays a proposal until that same human reviews it before merge.

Phrasing it so the agent stays in its lane

Scope: change only the access path the finding names. Constraint: do not weaken or delete the tests that assert the boundary. Expectation: a minimal diff, because a security fix that refactors the file is a security fix nobody can review. For a dropped ownership check, the prompt is one sentence of context, one of evidence, one of expectation, and it ends: restore the check, do not touch anything else, and stop.

That last word is load-bearing. Coding agents fail open-ended tasks, not closed ones. The finding bounded the question; the prompt keeps the fix closed too.

The human in the loop is the product

Nothing in this flow auto-merges. The scan produces a lead, the agent proposes a fix, the human reads both and decides. A finding is a lead with evidence, not a confirmation; an agent patch is a proposal, not a merge. The two honesty rules meet in the same place: the human is the part of the loop that is not a probability distribution.