Agent Controls

Copilot Administrators Can Now Set Operation-Level Approval Rules

By Kaleido Field Staff · September 10, 2026

Citation-ready: Copilot managed permissions use deny-before-ask-before-allow precedence; a managed ask rule requires fresh approval and cannot be satisfied by a saved approval or auto-approval setting.

Evidence boundary: GitHub launch and reference documentation. No enforcement test was performed; policy evaluation does not by itself establish complete sandbox isolation.

What happened and why it matters

The new control surface gives administrators a policy for individual operations. Its practical meaning comes from conflict resolution and supported clients, which the current reference makes explicit.

The dated source

Primary reference: GitHub managed-permissions launch and reference. Kaleido Field checked the event date and the article's attributed facts against this source.

A block wins over an approval shortcut

The reference defines deny, then ask, then allow precedence. An ask rule requires a one-time human decision even when an auto-approval preference or older approval might otherwise permit the action.

That lets an administrator distinguish reading a project file from publishing a change. Keep those actions separately specified; a broad conversational instruction should not stand in for an organizational policy.

Several allowlists narrow, not expand, access

When multiple applicable sources declare allowlists, GitHub uses their intersection. A source that does not declare one adds no restriction of its own to that key. The reference also describes when an unmatched supported operation defaults to requiring approval.

This matters during policy migrations. Testing only an explicitly denied command can miss whether an ordinary operation now prompts because it no longer matches every applicable allowlist.

Check the client, then test the boundary

The announcement names the app, CLI and Agent Host sessions in VS Code. Do not silently extend the claim to every IDE or cloud-agent surface. A separate sandbox configuration is a different control.

The approval-bypass analysis explains why permission prompts and isolation need distinct evidence. Retain the client version, loaded policy and observed decision for each trial.

Evidence boundary

GitHub launch and reference documentation. No enforcement test was performed; policy evaluation does not by itself establish complete sandbox isolation.