One Coding-Agent Account per GitHub Org

Binding repositories one at a time works until a client has forty of them, or until you clone a new one and forget. A Git remote rule binds a whole organization at once: every repository whose remote matches the pattern expects the same context, including repositories that don’t exist on your machine yet.

The short answer

aisw context create client-acme \
  --claude acme-claude --codex acme-codex \
  --gemini acme-gemini --antigravity acme-agy
aisw workspace bind --git-remote "github.com/acme/*" \
  --context client-acme
aisw workspace guard --mode strict

From then on, starting claude, codex, gemini, or agy inside any github.com/acme/... repository checks that the client-acme accounts are active first.

Before you start

Install aisw, run aisw init so the shell hook is in place, and save the organization’s accounts as profiles. The hook is what runs the check when an agent starts; without it, a binding is only visible through aisw workspace status.

Set it up

1. Group the organization’s accounts into a context.

aisw context create client-acme \
  --claude acme-claude --codex acme-codex \
  --gemini acme-gemini --antigravity acme-agy

A context can map any subset of tools. Leave out the agents you don’t use for that client.

2. Bind the remote pattern to the context.

aisw workspace bind --git-remote "github.com/acme/*" --context client-acme

The pattern is written without a scheme or user, the same way for GitHub, GitLab, Bitbucket, or a self-hosted host: gitlab.com/acme/*, bitbucket.org/acme/*, git.acme.internal/*.

3. Choose what happens on a mismatch.

aisw workspace guard --mode warn    # print a warning, let the agent start
aisw workspace guard --mode strict  # refuse to start the agent

Start with warn for a day to confirm the rule matches the repositories you expect, then switch to strict.

4. Check a repository.

$ cd ~/src/acme-api
$ aisw workspace status
Workspace
  Workspace     : ~/src/acme-api
  Repo root     : ~/src/acme-api
  Expected      : client-acme
  Active        : claude personal, codex personal, gemini personal, agy none
  Status        : mismatch
  Matched rule  : git_remote:github.com/acme/*
  Action        : aisw context use client-acme

Matched rule confirms the remote pattern resolved the repository, and Action is the command that brings the active accounts into line.

What the guard does on a mismatch

In strict mode, starting an agent with the wrong accounts active stops before the agent runs:

$ claude
Error: workspace guard refused to launch Claude Code.
  Expected context: 'client-acme'
  Current state: 'claude personal, codex personal, gemini personal, agy none'
  Status: mismatch
  Run 'aisw context use client-acme'.

Run aisw context use client-acme, start the agent again, and it launches on the client’s accounts.

How remote matching works

• Every remote counts. aisw reads all remote URLs in the repository’s Git config, not only origin. A personal fork with an upstream remote pointing at github.com/acme/... also resolves to the client context, which is usually what you want for client work.
• URL forms are normalized. SSH, HTTPS, and ssh:// URLs are reduced to host/owner/repo, with any .git suffix removed and letters lowercased before matching.
• * matches across slashes. gitlab.com/acme/* also covers nested groups such as gitlab.com/acme/platform/api.
• The most specific pattern wins. If you bind both github.com/acme/* and github.com/acme/billing, the billing repository uses the second rule.

Several organizations on one machine

aisw workspace bind --git-remote "github.com/acme/*" --context client-acme
aisw workspace bind --git-remote "github.com/globex/*" --context client-globex
aisw workspace bind --git-remote "github.com/my-employer/*" --context work
aisw workspace bind --default --context personal

The default context covers everything no rule matches, such as personal projects and scratch repositories.

When another rule takes priority

Remote rules sit third in the resolution order:

1. Repo-local binding written by aisw workspace bind . inside a clone
2. Path rule, such as aisw workspace bind ~/clients --context client-acme
3. Git remote rule
4. Default context

So a path rule on a parent directory overrides a remote rule. If a repository resolves to an unexpected context, run aisw workspace status and read Matched rule.

Remove the rule

aisw workspace unbind --git-remote "github.com/acme/*"

Removing a rule changes only which context is expected. It doesn’t remove profiles, contexts, or credentials.

Verify the result

Switch to your personal accounts with aisw context use personal, open any repository from the organization, and run aisw workspace status. It should report the organization’s context as expected and a mismatch as the status. Then run aisw context use client-acme and confirm the status reads match.