Copilot agent permissions: deny, ask, or allow

GitHub made Copilot agent permissions an admin decision on September 9. Every shell command, file read, file edit, and outbound network domain now falls under one of three policies an enterprise admin sets: deny, ask, or allow. The developer cannot loosen it. That last clause is the entire product.

What actually happened

The GitHub Changelog entry describes three permission categories — shell commands, file reads and edits, and network domains — each with a deny / ask / allow setting. Admins of GitHub Copilot Business or Copilot Enterprise configure them, and organizations can vary the policy by team.

The enforcement language is the part to read closely. Managed restrictions cannot be weakened by user settings, workspace settings, auto-approval, or previously saved approvals. If your policy says "ask before running curl," a developer who clicked "always allow" last Tuesday still gets asked. This is generally available across the GitHub Copilot app, Copilot CLI, and VS Code sessions running Agent Host.

It lands one day after GitHub put enterprise-managed sandbox policies for Copilot in JetBrains into public preview. Different surface, same direction: agent controls are moving off the laptop and into org configuration.

Why agent permissions matter for your business

Most teams we talk to have exactly one agent permission model, and it is the approval dialog. The dialog works until the third day, when a developer stops reading it and starts clicking through. Then "always allow" gets saved, and the policy is now whatever the fastest-typing person on your team decided at 4:50pm on a Friday.

The three categories map cleanly onto the three ways an agent actually hurts you.

Shell commands are how an agent destroys state — a git reset --hard, a DROP TABLE against the wrong DATABASE_URL, an rm -rf with a variable that resolved to empty.

File reads are how it leaks. An agent that can read .env and can also reach the network is a two-step exfiltration path, and neither step looks like an attack in a log.

Network domains are the choke point that makes the other two survivable. Allowlist your package registry, your API, your error tracker. Deny the rest. An agent that cannot call out cannot send anything out.

If you are not on Copilot Business, the lesson still applies: pick the tool that lets you set this centrally, then actually set it. A control each developer can toggle is not a control.

Sources: GitHub Changelog, GitHub Changelog: JetBrains managed sandbox.