Enterprise managed permissions for GitHub Copilot agent operations
Copilot Business and Enterprise admins can now deny, require approval for, or allow specific agent shell, file, and network actions org-wide.
GitHub Copilot Business and Enterprise administrators can now set enterprise-wide rules for what Copilot's coding agent is allowed to do. The new managed permissions cover shell commands, file reads and edits, and network domains, and each can be set to deny, ask (require one-time approval), or allow (proceed without a prompt).
- Deny and ask rules set at the enterprise level can't be overridden by user or workspace settings, auto-approval, or previously saved approvals.
- Administrators can define specialized policies for different enterprise teams rather than one policy for the whole organization.
The controls are generally available now in the GitHub Copilot app, GitHub Copilot CLI, and GitHub Copilot sessions in Visual Studio Code that use Agent Host. Full configuration details are in the enterprise managed settings documentation.
GitHub
Where the world builds software — Git hosting, pull requests, issues, Actions CI/CD, and Copilot, free for public and private repos.
View GitHub →