Skip to content
NewsProduct launch

GitHub Copilot's AI-judged permission mode goes generally available

· by

The short version

GitHub's Copilot CLI, app, and VS Code extension can now let a large language model approve routine permission requests on its own, with administrators able to restrict or turn off the mode, per GitHub's October 26, 2026 changelog.

GitHub Copilot's AI-judged permission mode goes generally available

A model inside GitHub Copilot now decides, on its own, which of the shell commands, file edits, and URL fetches it wants to run are safe enough to skip asking a human first. GitHub took that mode, called assisted permissions, out of preview and into general availability on October 26, 2026, across Copilot CLI, the Copilot app, and Visual Studio Code, per GitHub's changelog.

What

Copilot's permission system now offers three modes, according to GitHub's documentation: manual approval, which prompts for every command, file write, or URL access that isn't already allowed; assisted permissions, where a model screens eligible requests and auto-approves the ones it judges safe; and unconditional approval (--allow-all or --yolo in the CLI), which skips model review and individual prompts entirely. Users turn on assisted mode with /permissions in Copilot CLI, through the mode picker's Tool permissions setting in the Copilot app, or via the permissions picker in VS Code, GitHub's changelog says.

When a request qualifies for review, the model recommends approve or escalate. If it is confident the action is safe, Copilot proceeds without a prompt; if not, the session falls back to asking the user, the same as manual mode, per GitHub's documentation. GitHub picks which model runs that safety check, and that model can differ from whatever model is handling the user's actual conversation; if the chosen reviewer is unavailable, the session's active model takes over instead. Administrators get three new levers: they can block the unconditional "Allow All" mode while leaving assisted permissions available, disable assisted permissions outright, or set which mode new sessions start in by default.

An admin's own 'ask' policy can now be cleared by the model instead of a person

GitHub gave enterprise admins centralized deny, ask, and allow rules for Copilot's shell commands, file access, and network domains when it shipped managed permissions to general availability on September 9, 2026, per that changelog. Assisted permissions changes what "ask" means inside that system. GitHub's documentation states that enterprise ask rules for shell commands, file reads, file writes, and URLs can be satisfied by model approval when the request is eligible for review, so a rule an admin wrote expecting a human to sign off does not always produce a prompt once assisted permissions is on. Deny rules are unaffected and still block the action regardless of mode.

GitHub does not hide the risk. Its own documentation warns that assisted permissions reduces how often a user is prompted but does not remove responsibility for what Copilot does, that the model can make mistakes and approve dangerous or unintended actions, and that the feature is not a substitute for sandboxing or access restrictions. For a team that adopted managed permissions in September specifically to keep a person in the loop on "ask"-tier actions, the practical move is to check whether permissions.disableAssistedPermissionsMode is set, since leaving assisted mode available lets the model clear some of those same requests on its own.

Context and reactions

Neither GitHub nor Microsoft issued commentary beyond the changelog entry itself; both the feature announcement and the risk warning come from GitHub's own blog and documentation, with no independent security researcher or outlet weighing in within the first day of the GA release. The move follows a pattern GitHub has run through 2026: ship a capability in preview, then layer enterprise guardrails around it before taking it fully GA. Managed permissions arrived in September as the guardrail layer for agent operations generally; assisted permissions is the first mode that puts a model, rather than a static rule set, inside that guardrail's decision path. GitHub's own framing treats this as a prompt-reduction feature rather than a security control, pointing developers toward its existing sandboxing guidance in the Copilot CLI documentation for anyone who wants stronger isolation than a model's judgment call provides.

What to watch next

Watch whether enterprises that adopted managed permissions in September respond by setting permissions.disableAssistedPermissionsMode to keep "ask" rules tied to a human, or by adopting assisted permissions as their org-wide default now that GitHub allows admins to set that default centrally. A reported incident involving an auto-approved command would be the clearest sign the model's safety judgment needs tightening before more enterprises turn the mode on.

Sources