GitHub locks Copilot agent permissions above user control

GitHub made enterprise-managed permissions for Copilot agent operations generally available on September 9. Business and Enterprise admins can now set which agent operations are blocked, require human approval, or run without a prompt. That covers shell commands, file reads and edits, and network domains, per GitHub's changelog post.

For any team that's tried to get an AI coding agent approved for a codebase with real credentials attached, this is the missing piece. Most agent permission systems put the developer in charge of what the agent can touch. This one puts the enforcement point above the developer entirely.

The restrictions can't be loosened by user settings, workspace settings, auto-approval, or an approval a developer already saved before the policy existed. An admin sets the rule once, and it holds whether the agent is running in the Copilot app, the Copilot CLI, or a VS Code session using Agent Host. Policies can also differ per enterprise team, so different teams don't have to run under identical rules.

That closes a specific hole. I've watched agents auto-approve their way past a permission prompt because some earlier saved setting let them. An org-level policy that can't be overridden locally kills that path for good, not just for one session.

What the changelog doesn't say is how granular the network domain rules get, or whether a blocked operation gets logged anywhere an admin can review later. That audit trail question matters more than whether the blocking itself works. It's the next thing to ask GitHub.