[FAQ] Add: external admission authority vs guardrail validation

[chrizbo]

Adds a new FAQ entry under the Guardrails section addressing the question of whether gh-aw's built-in guardrail validation constitutes genuine external admission authority.

What changed

New entry: "Who owns the final admission decision — is guardrail validation the same as external admission authority?"

The entry:

• Clarifies that gh-aw's default guardrails (threat detection, output limits) are internal to the execution system — they answer whether output looks acceptable, not whether the execution intent is allowed by a separate authority boundary
• Documents two supported extension points for genuine external admission:
  1. GitHub Actions environment protection rules on custom safe-output jobs
  2. Custom threat-detection.post-steps: calling an external policy service
• Notes that neither is enabled by default, and recommends opting in for high-privilege operations

Source

Community question from @pinfloyd in a discussion thread about safe outputs, captured in github/agentic-workflows#484.

Type of change

New FAQ entry (no changes to existing entries).

Generated by Feedback Question Answerer for issue #484 · ● 1M · ◷