Let me walk you through a complete workflow: a GitHub PR review bot. A webhook fires when a PR is opened. Your Gateway receives the event and routes it to your Pair Programmer agent. The agent then reviews the diff using gh pr diff.
Your agent checks for common issues like missing tests and large functions. It posts review comments directly on the PR using gh pr review. If it finds no issues, it approves the PR. If it finds problems, it requests changes with inline comments.
Set this agent's tools.exec.ask to "never" for gh commands so reviews happen automatically. Deny it access to git push so it can comment but never merge. See how tool restrictions protect you even in automated workflows?