GitHub announced enterprise managed permissions for Copilot agent operations on September 9, 2026. For teams delegating development work, the practical change is centralized control over actions that previously might have depended on an individual’s settings.
We reviewed the announcement and settings reference on September 10. This article provides a rollout approach; we did not deploy these settings in an enterprise tenant.
What changed, and who can use it?
The GitHub announcement names Copilot Business and Enterprise and covers the Copilot app, CLI and VS Code sessions using Agent Host. Administrators can govern shell commands, file access and network domains.
Check the exact client used by each team. “We use Copilot” is not a precise rollout scope. A policy that works in one supported client should not be assumed to protect every editor, remote agent or automation path.
How do deny, ask and allow interact?
The managed settings reference defines this precedence:
| Rule | Documented effect |
|---|---|
| deny | Blocks a matching operation even if another rule allows it |
| ask | Requires fresh approval for each matching operation |
| allow | Permits a matching operation without a prompt, subject to stronger rules |
Applicable managed allowlists intersect. A managed ask cannot be satisfied by bypass mode, auto-approval or an earlier persisted approval. These details matter when several policy sources apply to the same person.
Before rollout, write down which policy sources contribute to the effective configuration. Otherwise, a developer may see an unexpected approval request and mistake a deliberate restriction for a broken tool.
How should you validate a policy?
Use a disposable workspace and harmless operations. The following is our proposed acceptance checklist, not a set of reported test results:
- Choose a supported operation intended to be allowed and confirm it proceeds.
- Choose one intended to require approval; run it twice and confirm approval is requested again.
- Choose one intended to be denied and verify it remains blocked despite a local approval setting.
- Test an operation matched by conflicting rules and inspect the effective policy.
- Repeat in every client and team configuration you intend to support.
Keep the policy revision, client version, operation and observed decision together. A screenshot of a settings page is weaker evidence than a repeatable operation with the expected result.
What remains outside this decision?
An approval rule is not a complete sandbox. A permitted command can invoke scripts or dependencies with additional effects. Network policy, filesystem isolation, credentials and local MCP access deserve separate review in the environment that runs the work.
Likewise, permission to edit a file does not establish that the edit is correct. Preserve ordinary review and acceptance checks. The agent governance guide provides a broader framework for ownership and escalation.
What should you update in your team workflow?
Document three owners: the person maintaining managed settings, the person responsible for the execution environment and the reviewer accepting code changes. Establish how a developer reports an unexpected block, and how the team tests a policy adjustment before expanding it.
If the same team is adopting a new model, keep the changes separate enough to explain failures. Read the GPT-6 Astra Copilot access guide for model eligibility. If execution is moving to your own infrastructure, the Cursor self-hosted data-flow analysis explains why location and permission are separate decisions.
Frequently asked questions
Can a saved approval bypass a managed ask rule in Copilot?
No. GitHub documents that a managed ask rule requires fresh, one-time approval. Bypass mode, auto-approval and a previously persisted grant cannot satisfy that rule.
Do managed permission rules apply to every Copilot client?
Do not assume universal coverage. The September 9 launch names the Copilot app, CLI and VS Code sessions using Agent Host. Check the current client support table before deploying a policy.
Do agent permissions replace sandboxing or code review?
No. Permissions decide whether a supported operation may proceed. A sandbox limits what execution can access, while review checks the resulting change. Validate each layer separately.