A useful security-agent workflow focuses on the trust boundaries and abuse cases introduced by a specific change, then reports verified evidence instead of a generic vulnerability checklist.
Define the security boundary
Document the assets, actors, authorization rules, untrusted inputs, secrets, network or filesystem access, dependency changes, and relevant abuse cases. The Security Reviewer uses the card and repository implementation as its review context.
Run a focused assessment
Add Security as a recipe step for an advisory review or configure it as a read-only merge gate for selected priorities. A merge-gate review checks the exact pull-request commit and cannot edit, commit, push, or create another pull request.
Act on evidence
For each validated issue, review the impact, code evidence, and proposed remediation. Warnings and uncertainties need an explicit human decision; a pass does not certify that the application is secure.