AI 程式開發與治理
GitHub Brings Copilot App and Cloud Agent Under Centralized Policies, Enabling Cross-Client Controls for Plugins and Approval Bypasses
GitHub’s `managed-settings.json` now governs Copilot App, the cloud agent, CLI, and VS Code, while desktop App access has been separated from CLI policy. Existing enterprise defaults will continue to enable the App, so administrators pursuing a closed rollout must proactively review the new policy and plugin allowlist.
On July 27, GitHub closed a key gap in Copilot’s multi-client governance: the centrally managed enterprise `managed-settings.json` now applies to GitHub Copilot App and Copilot cloud agent in addition to Copilot CLI and VS Code. Enterprise administrators can use a single JSON file to specify which plugins are allowed, which marketplaces may be used to install plugins, whether developers may bypass approval prompts before command execution, file access, or URL fetching, and whether new conversations default to automatic model selection. Centrally managed values take precedence over developers’ local settings.
Deployment primarily uses the enterprise’s `.github-private` repository, with the policy file located at `copilot/managed-settings.json`. GitHub says supported clients retrieve updates within about an hour or after restarting or signing in again, while the cloud agent applies them the next time it receives a task. Policies can also be deployed through MDM or distributed file deployment. One important caveat is that approval-prompt bypass controls apply only to the interactive App, CLI, and VS Code. The cloud agent primarily inherits plugin and marketplace restrictions, so the two execution surfaces are not fully symmetrical.
On the same day, GitHub also separated Copilot App access from the Copilot CLI policy. Enterprises and organizations can independently choose to enable it everywhere, disable it everywhere, or allow subordinate organizations to decide. The separation is reasonable because the desktop App can launch multiple agent workspaces in parallel, use local or cloud sandboxes, schedule automations, and load MCP servers and agent skills. Its risk profile is clearly not equivalent to that of a standalone CLI.
The migration pitfall is that the new App policy defaults to enabled everywhere. Organizations that previously disabled or restricted only the CLI cannot assume those same restrictions will automatically block the App. Engineering and security teams should inventory all four execution surfaces—the App, CLI, VS Code, and cloud agent—test policy propagation delays, plugin sources, and BYOK model paths, and verify that beyond PR review, CI, and audit logs, actual command execution and network access remain constrained by the intended sandbox and approval mechanisms.