Scope an autonomous agent before an org-wide rollout

Your company wants to roll out an autonomous coding agent across all 400 of its repositories. The proposed setup gives it read access to every private repo, so it has full context. It can open PRs anywhere, and it can run any shell command in CI to test its changes. A few repos hold customer data pipelines, and one holds the release signing keys.

You are reviewing the rollout. What risks do you raise, and what scoping do you require before it goes ahead?