Bind Every Agent Commit to the Human Who Asked, in the System
The two most documented cloud agents in production answer "whose name is on the commit" with the same rule and opposite mechanics. GitHub Copilot cloud agent authors commits as Copilot and adds the requesting developer as a Co-authored-by trailer. Ramp's Inspect, which writes roughly 30% of all PRs merged to Ramp's frontend and backend repos, clones with an app token but opens every pull request with the requesting user's own GitHub token.
Binding is the second half of assigning work to an agent. Giving the agent a distinct identity makes AI-authored work distinguishable; binding ties that identity to the human who initiated the task. What it buys you when an auditor asks "whose identity is on this commit?" is attribution.
The trailer model: agent authors, human co-authors, system signs
GitHub's risks-and-mitigations doc describes three layers, each answering a different forgery:
| Layer | Mechanism | What it prevents |
|---|---|---|
| Authorship | Commits authored by Copilot, requester as co-author | AI work passing as human work |
| Integrity | Commits signed, shown "Verified" on GitHub | Tampering with or impersonating agent commits |
| Evidence | Each commit message links to the agent session logs | "What did it actually do?" going unanswerable |
When an automation runs Copilot on a schedule, with no person initiating each task, GitHub attributes the PR to the user who created the automation. There is no unowned work; the binding chases the human up one level.
The binding has teeth: the person it binds to cannot approve the result. GitHub explicitly prevents the user who asked Copilot to create a pull request from approving it, preserving the "Required approvals" branch rule. Asking the agent counts as authoring. That is the author-never-approver rule applied through the binding rather than around it.
Ramp's rule: the PR opens with the requester's token, on purpose
Inspect's snapshot images are built every 30 minutes with a GitHub app installation token, because at build time nobody knows which user will consume the image. Identity is applied later: the sandbox sets user.name and user.email at commit time, pushes the branch, then sends the branch name and session ID to the API, and the API calls GitHub's pull request endpoint with the requesting user's own token.
Ramp states the reason plainly: opening PRs as the app itself "would allow for any user to approve their own changes. You do not want to knowingly create a vector for unreviewed code to go into the codebase." The user-token rule makes GitHub's existing self-approval block do the segregation-of-duties work for free.
The binding survives multiplayer too. Inspect sessions are shared, and Ramp's instruction is to pass "authorship info to each prompt that's sent to the coding agent," so each person's prompt that causes code changes is attributed to them, not to whoever opened the session. More on shared sessions in multiplayer.
One gap: Ramp's writeup is silent on commit signing. GitHub and Cursor both document signed agent commits; Ramp does not say whether Inspect signs them.
Prompt-level attribution does not hold, in either direction
The 2025–2026 Reddit record is a controlled experiment nobody meant to run. Users who wanted trailers gone could not remove them with instructions: a Claude Code thread reports the trailer surviving "every possible configuration saying not to," and a Cursor user paying $10k/month found AGENTS.md rules ignored the same way. Meanwhile a team that wanted trailers enforced built a commit linter because per-user settings could not guarantee team-wide policy. Attribution policy only holds where it is enforced: in the environment and the git plumbing, not in the prompt. GitHub's trailer and Ramp's token rule both live below the model's reach, which is why they work.
The Linux kernel reached the same design from the institutional side. Its 2026 AI rules, discussed at length on r/ExperiencedDevs (score 306), add an Assisted-by: tag recording the model and tooling, while no AI ever gets a Signed-off-by. The human signs off; the machine stays metadata.
The trailer already did forensic work
In February 2026, Moonwell, a lending protocol controlling $100M+ in assets, lost $2M to a bug that the dev community traced to a commit co-authored by Claude. Treat that at the confidence level the Moonwell incident page gives it: community-sourced, with no public postmortem in the corpus. Even at that confidence level, the trailer did real forensic work. It is how the world knew which commit was AI-authored.
That cuts both ways, and practitioners know it. The top comment on the r/git thread that named the question (score 106) is sarcasm: "Guys trust me I didn't wipe our production database it was Claude!!!" The trailer identifies the tool; it does not transfer responsibility to it. The norm in the same thread is the one these mechanics encode: "I authored it. I'm responsible for it, not an AI." The binding exists so that sentence always has a name attached, which is the same reason accountability stays human no matter how much of the work the agent did.