AI 程式開發與安全
GitHub Copilot Expands Content Exclusion Policies to App and CLI, but Symbolic Links and Indirect Semantics May Still Cross Boundaries
Exclusion rules configured by Copilot Business and Enterprise administrators can now prevent the Copilot App and CLI from directly adding specified files to model context. The mechanism is not comprehensive data loss prevention or an execution sandbox; GitHub still lists gaps involving symbolic links, remote file systems, and indirect IDE semantics.
GitHub announced on September 2 that the Copilot App and Copilot CLI now officially support content exclusion policies at the enterprise, organization, and repository levels. Administrators can specify files that models must not read by repository and path. For developers with Business or Enterprise licenses, excluded content should no longer be directly included in prompt context by these two agent interfaces. This closes a governance gap that arose when agents browsed entire workspaces from a terminal or standalone application.
The policies do not exist solely in client-side settings. According to GitHub documentation, the client sends the current repository URL to retrieve the applicable rules; GitHub says these URLs are not logged. Organizations can also read and write path rules through a versioned REST API, making it suitable for incorporating configuration into infrastructure-as-code and audit workflows. However, the API remains in public preview and does not support comments or duplicate keys. Updating rules through the API may remove existing comments, while only the final entry is retained for duplicate keys, meaning direct round-trip synchronization can silently lose configuration data.
More importantly, “exclusion” is only a context filter. GitHub explicitly states that an IDE may indirectly provide Copilot with semantics derived from excluded files through type information, symbol hover definitions, or build configuration. The rules also do not currently apply to symbolic links or remote file systems. Edit and Agent modes in some editors still lack equivalent support. Teams therefore cannot treat content exclusion as secrets management, data loss prevention, or a file-system sandbox.
During rollout, teams should use a test repository to validate every Copilot interface and manage content exclusions separately from the CLI’s tool allow/deny rules, trusted directories, operating-system isolation, and credential scanning. The next metric worth tracking is whether GitHub can provide verifiable policy-match logs and establish consistent enforcement boundaries across symbolic links, remote workspaces, and all agent modes.