Protected files prevent AI agents from modifying critical configuration, infrastructure, or security-sensitive files during automated ticket resolution. Mark files as protected in your project settings, and AppHandoff will flag any agent-generated pull request that touches those paths before it reaches human review.
Common protected file patterns include CI/CD workflows, environment configuration templates, database migration directories, and authentication modules. You can specify exact paths or glob patterns. Protected file rules apply to all agents connected through MCP and are enforced at the ticket and PR level, not just at the repository branch protection layer.