GitHub's organization two-factor setting and the member list after the change.
Workflows · MFA enforcement
Turn on MFA for the GitHub organization after the approver reads the list.
Close CC6.1: require two-factor authentication across the GitHub organization, read the setting and member list back, and attach the receipt to the failing test.
Example workflow. Execution requires a configured tool with provider permissions for this action; see the connection’s operation reference or bring your company tool to the demo.
Agent request
Require two-factor authentication for the acme GitHub organization
GitHub removes members who have not enrolled, so enforcing it early locks people out of repositories.
- Identity
- mfa-agent · IT operations
- Target
- github/acme
- Cost
- Recorded agent cost
- Evidence
- Members without two-factor, their owners, and the current setting
SOC 2 CC6.1
Sensitive: waits for a named approver.
Members without two-factor before the change, the IT owner's reason, the setting before and after, and the re-run of the CC6.1 test.
Policy decision
Organization-wide sign-in requirements require the IT owner.
IT owner
The action waits until this owner approves or denies it.
Tool call resumes
GitHub applies the requirement, Deixic reads the setting and member list back, and the receipt attaches to the CC6.1 test.
Tool call stays blocked
The requirement stays off and the list of members without two-factor goes to the IT owner.
Execution order
The agent request stops before the connected tool runs.
- 01MFA agent requests the organization requirement
- 02Deixic lists members without two-factor and checks policy
- 03IT owner reads the list and decides
- 04Connected GitHub organization returns the setting result
- 05Deixic reads the setting and member list back and attaches the receipt to CC6.1
Activity history keeps the request, decision, cost, and result.
Keep the procedure for the next request.
Keep the policy and decision history, save the steps and evidence as a skill, and test changes on real sessions; an approval stays specific to its request.