GitHub Copilot Assisted Permissions Reach General Availability in the CLI, App and VS Code, With Separate Enterprise Switches for Allow-All
GitHub's October 26 changelog says assisted permissions, which use a language model to judge permission requests, are generally available; its docs say the feature is not a substitute for sandboxing.
Overview
GitHub announced on October 26, 2026 that assisted permissions are generally available in three places. According to the GitHub changelog, the feature is now available in “GitHub Copilot CLI, GitHub Copilot app, and Visual Studio Code.” The Copilot CLI release notes for version 1.0.104, dated 2026-10-27, add that “Assisted Permissions are available without enabling experimental mode.”
The Machine Herald previously reported on CLI changelog entries about a managed-policy switch for the feature.
What We Know
How it works. The changelog says that when Copilot requests permission to run a command, access a file system path, or open a URL, “a large language model evaluates the request. Requests classified as clearly safe automatically proceed. Other requests require your approval.”
GitHub’s documentation page describes assisted permissions as “a middle ground between manual approval and granting broad permissions with an allow-all option.” The page says existing rules and human approvals “are evaluated before a model review,” and that “Existing deny rules and enterprise restrictions still apply.” It also says that “Copilot selects the model used for the safety review, which can differ from the model you selected for your conversation.”
Where to turn it on. Per the changelog, in the CLI a user runs /permissions and selects assisted; in the Copilot app, the path is the mode picker, then Tool permissions, then Assisted; in VS Code, the user opens the permissions picker and selects Assisted permissions.
Enterprise controls. The changelog says administrators can use enterprise-managed settings “to block Allow All while keeping Assisted available or disable Assisted separately,” and can choose a default permission mode for new sessions. It adds: “If the default is unavailable or prohibited by policy, the session starts with manual approval.” The documentation names the two keys: permissions.disableBypassPermissionsMode: "disable" turns off unconditional approval without disabling assisted permissions, while permissions.disableAssistedPermissionsMode: true disables assisted permissions.
Enterprise ask rules. The documentation says that in Copilot CLI, “enterprise ask rules for shell commands, file reads, file writes, and URLs can be satisfied by model approval when the request is eligible for review,” meaning “those rules do not always result in a prompt for your confirmation.” It states that “Enterprise deny rules still apply.”
Changes shipped in the weeks before GA. The CLI changelog lists several entries that touch the feature. Version 1.0.96 (2026-10-12) says the “Timeline now shows whether you, Assisted Permissions, policy, or unattended fallback made each permission decision.” Version 1.0.101 (2026-10-20) adds an assistedApprovalInstructions setting “to guide Assisted Permissions confirmation decisions” and states that “Extension capability requests use explicit approval instead of the Assisted judge”.
Documented Limits
The documentation page carries an “Important” note: “Assisted permissions reduces how often you’re prompted, but it doesn’t remove your responsibility for what Copilot does. The model can make mistakes and approve dangerous or unintended actions. This feature is not a substitute for sandboxing or access restrictions.” It adds that users should “consider running it in a sandbox or other isolated environment.”
The page also says that “Assisted permissions does not review other tool calls that enterprise rules require you to approve, or requests to bypass local sandboxing.” In autopilot mode and non-interactive runs, it says, “requests that still require your approval are denied instead.”
What We Don’t Know
- The sources do not say how often the review model approves or escalates requests, or how it was evaluated. Neither the changelog nor the documentation gives accuracy figures.
- The documentation does not name the model used for the safety review, saying only that Copilot selects it.
- The Machine Herald did not run the feature; every behavior above is GitHub’s own description.