GitHub announced on October 26, 2026 that assisted permissions are generally available across Copilot CLI, the Copilot app and Visual Studio Code. For developers and people maintaining business websites or internal tools, the change offers a way to delegate some approval decisions to a model.
A tool request is a proposed action, such as running a command, changing a file or opening a web address. Assisted can approve eligible requests; others still need your confirmation in an interactive session. The choice is how much authority to delegate, not simply how many prompts to remove.
Choose the approval mode for the work
A useful starting point is the consequence of an incorrect approval. The recommendations below distinguish work you can inspect and undo from actions that must wait for a person.
Mode | How approval works | When to consider it |
|---|---|---|
Manual | You handle requests not already authorized by applicable rules. | Unfamiliar projects, or work where a person needs to inspect an action before it proceeds. Check existing grants too. |
Assisted | A model approves eligible requests it judges acceptable; unresolved requests need your confirmation in an interactive session. | Bounded work in a familiar project, with restricted access and changes someone will review. |
Allow all | Broad approval removes individual confirmation and model review, subject to applicable denials and enterprise restrictions. | Only where broad authority is intentional and the environment is appropriately isolated—not just because prompts are inconvenient. |
GitHub’s CLI permission guide explains that manual mode still honors existing permissions. Some approvals persist for a project; permanent URL approvals apply across sessions. Review saved grants as well as the selected mode.
Microsoft also cautions that model-based approval can be mistaken. A quieter session is therefore not, by itself, evidence of safer work or stronger oversight.
Limit access separately
Make two decisions: who approves an action and what it can reach.
GitHub documents local sandboxing as a separate, off-by-default control for CLI and app sessions. It restricts access to files, networks and system capabilities. Enabling it in one client does not configure the other.
That isolation has limits: GitHub’s local sandbox is not a separate virtual machine, and built-in CLI file tools check its policy themselves on a best-effort basis. Check the tools and operating system involved before assuming every action is contained.
For example, when asking an assistant to update a business website, a sensible design is to let it work on a development copy without production access, then review changes before deployment. This is a recommended separation of responsibilities, not a promise that Assisted will make the right decision.
An “ask” rule may not mean a human checkpoint
GitHub’s assisted-permissions guide says eligible CLI requests for shell commands, file reads, file writes and URLs can satisfy enterprise ask rules through model approval. Enterprise denials still apply. Do not assume this CLI exception describes every client.
Administrators can disable unrestricted approval and assisted approval separately: permissions.disableBypassPermissionsMode set to "disable" blocks bypass mode; permissions.disableAssistedPermissionsMode set to true blocks Assisted. Neither switch replaces the other.
A managed default chooses a starting mode; users can still select another permitted mode. If a person must authorize an operation, the practical implication is to restrict alternative approval modes and review the applicable allow, ask and deny rules—not merely set a manual default. Validate that policy in the actual client and session type.
Check the session you are using
Copilot CLI: Use
/permissions showto inspect the mode,/permissions assistedto select Assisted, or/permissions manualto return to manual approval. These controls are documented in the CLI guide.Copilot app: Selecting Assisted in the local-session menu also sets the default for new local sessions. Cloud sessions lack these controls; remote-host support varies. See the app instructions.
VS Code: The current setup guide specifies Copilot harness sessions—the Copilot agent environment—with Folder isolation and
chat.assistedPermissions.enabledturned on. Local harness sessions do not offer Assisted; Worktree sessions use Allow all. A working copy is not itself a sandbox.
Unattended runs need an additional check
For non-interactive CLI work, GitHub documents --assisted-approval. Requests still needing approval are denied, including in CLI autopilot mode. Check for skipped steps rather than assuming a finished run completed every requested action.
The same guide’s startup warnings matter: successfully enabling Assisted overrides --allow-all-tools, but leaves --allow-all-paths and --allow-all-urls unchanged. Combining it with --allow-all or --yolo can leave paths and URLs unrestricted. If Assisted cannot start, the CLI warns on standard error but does not cancel a separately supplied --allow-all-tools.
Avoid carrying permissive flags into a job by habit. Review its warnings, reachable resources and resulting changes. Teams using multiple assistants should also check Claude Code’s separate unattended-permission defaults; its rules are not Copilot’s.
Access does not mean unlimited usage. All Copilot plans, including Free, include the CLI and app, but allowances and model access differ. GitHub’s individual billing guide meters CLI usage in AI credits based on model and token consumption; it does not specify a separate per-permission-review price.
Start with the smallest task you are comfortable delegating. Keep human authorization where the consequence demands it, constrain access independently, and review the result before giving the next run more authority.