Allowing safe commands to run without manual approval

Introduction

When Copilot works on a task, it often needs to take actions that could change your system, such as running shell commands, editing files, or accessing URLs. You can choose how permission requests for these actions are handled.

Answering approval prompts keeps you in control, but it can slow you down, especially at the start of a session when Copilot needs to establish which actions it's allowed to take. To reduce the number of prompts, you can grant Copilot unconditional permissions—but doing so removes your oversight of individual actions.

Assisted permissions is a middle ground between manual approval and granting broad permissions with an allow-all option. It uses a large language model to review permission requests and automatically approve actions it judges to be safe in the context of your task. In a standard interactive session, requests that still require approval are put to you.

Approval options

You can choose between three options that determine how much you want to be involved in approving the actions Copilot takes. Existing deny rules and enterprise restrictions still apply. Requests that are already allowed by your permissions can run without a prompt or a model review.

• Manual approval: Copilot asks for your approval when an action isn't already allowed, such as running a command that isn't read-only, editing a file, or accessing a URL. You can approve an action once, or for the rest of the session. This gives you the most oversight, but requires you to respond to the most prompts.

• Assisted permissions: Copilot uses a model to assess eligible permission requests and automatically approves those it judges to be safe. You are prompted when a request still needs your approval. This reduces prompts without granting blanket permission to run commands.

• Unconditional approval: Copilot has broad permission to use tools, paths, and URLs without a model safety review or individual approval prompts. This is the most permissive option and removes your oversight of individual actions. This is the behavior you get in Copilot CLI when you use the --allow-all (or --yolo) command line option, or the /permissions allow-all (or /yolo) slash command.

Your administrator can disable unconditional approval with permissions.disableBypassPermissionsMode: "disable" without disabling assisted permissions. The separate permissions.disableAssistedPermissionsMode: true setting disables assisted permissions. For more information, see Enterprise managed settings.

How assisted permissions works

When you enable assisted permissions, existing rules and human approvals are evaluated before a model review. For eligible requests that aren't already resolved—whether to run a command, access a path, or fetch a URL—the model assesses whether the action is safe and within the authority you gave for the task.

In Copilot CLI, enterprise ask rules for shell commands, file reads, file writes, and URLs can be satisfied by model approval when the request is eligible for review. This means those rules do not always result in a prompt for your confirmation. Enterprise deny rules still apply.

Assisted permissions does not review other tool calls that enterprise rules require you to approve, or requests to bypass local sandboxing. Those requests remain subject to the session's normal permission handling.

For requests it can review, the model makes a recommendation:

• If the model is confident that the request is safe, Copilot approves it automatically and continues, without prompting you.
• If the model is not confident that the request is safe, Copilot asks for your approval, as it would with manual approval.

If a safety review is unavailable or cannot evaluate a request, the request follows the session's normal permission handling.

Copilot selects the model used for the safety review, which can differ from the model you selected for your conversation. If the selected review model is unavailable, the review can use your session's active model instead. If you use your own model provider, the review uses your session's active model.

Using assisted permissions in the GitHub Copilot app

To turn on assisted permissions for a local session:

1. In the prompt box, open the mode menu, which shows the current mode, such as Interactive, Plan, or Autopilot.
2. Click Tool permissions, then select Assisted.

Your selection applies to the current session and is also saved as the default for new local sessions. It does not change other existing sessions. To change the default without changing the current session, open Settings, select Sessions, and choose Assisted under Tool permissions.

To turn on assisted permissions for only the current active session, without changing the default, enter /permissions assisted in the prompt box. Enter /permissions manual to return that session to manual approval, or /permissions show to check its permission mode.

Tool permission controls are not available for cloud sessions. For sessions on a remote host, the available permission modes depend on what that host supports. Administrator restrictions still apply, even if you select Assisted as your default.

Using assisted permissions in GitHub Copilot CLI

There are three ways to turn on assisted permissions, depending on whether you want it for the session you're in, for every new session, or for a single automated run.

Turning it on during an interactive session

Enter the following slash command:

/permissions assisted

/permissions assisted

To return to manual approval, enter /permissions manual. To check which permission mode you're currently in, enter /permissions show. You can also enter /permissions, with no argument, to choose a mode from a list.

Making it the default for new sessions

To make assisted permissions your preferred mode for new interactive sessions, set defaultPermissionMode to "assisted" in your user configuration file (~/.copilot/settings.json). You can edit the file directly, or use the /settings slash command during a session. For more information, see GitHub Copilot CLI configuration directory.

The setting applies to new interactive sessions only. If your administrator sets permissions.defaultMode, that managed default takes precedence over your preference. You can still choose a different mode for a session, such as with /permissions manual, if policy permits it.

Resumed sessions keep their saved permission mode, subject to current policy restrictions. The --allow-all or --yolo option takes precedence over either default if policy permits it. If the selected default is unavailable or blocked by policy, the CLI starts with manual approval.

To make manual approval your preferred default, set defaultPermissionMode to "manual". If neither you nor your administrator has configured a default, new sessions can start in manual or assisted mode. Use /permissions show to check.

Using it for a non-interactive run

When you run Copilot CLI non-interactively—with the -p or --prompt option, or in an environment with no terminal attached, such as a CI/CD workflow—use the --assisted-approval command line option:

copilot -p "Fix the failing tests" --assisted-approval

copilot -p "Fix the failing tests" --assisted-approval

You can also set the COPILOT_ASSISTED_APPROVAL environment variable to true, which is useful in automated environments where you can't easily change the command that's run.

This option is only for non-interactive runs. If you use it when starting an interactive session, the CLI exits with an error. To use assisted permissions in an interactive session, use /permissions assisted or the defaultPermissionMode setting instead.

When to use the command line option

In a non-interactive run there is nobody available to answer approval prompts, so you would otherwise have to choose between two unappealing options. Without any permission options, Copilot is denied anything that needs approval, and often can't finish the task. With --allow-all-tools, you grant blanket tool permissions without a model safety review.

--assisted-approval is the middle ground. Requests the safety review judges to be safe are approved automatically. If the review requires your approval, the request is denied and its explanation is passed back to Copilot so it can try a different approach. Other requests that still require approval are also denied.

Consider using it when you want an unattended run—in a CI/CD workflow, a scheduled job, or a batch script—to complete real work without giving Copilot unconditional permission to run any command.

For more information about running Copilot CLI programmatically, see Running GitHub Copilot CLI programmatically.

How assisted permissions behaves in Copilot CLI

• Turning it on in a session affects only that session. When you enter /permissions assisted, assisted permissions stays on for the rest of that session, unless you turn it off. It doesn't affect any other sessions you currently have open. To apply it to future sessions, use the defaultPermissionMode setting described above.

• You can switch to assisted permissions at any time. If you started a session with the most permissive setting (--allow-all or its alias --yolo), entering /permissions assisted switches you from unconditional approval to assisted permissions.

• You can turn on assisted permissions while Copilot is working. You don't have to wait for a task to finish. Subsequent eligible permission requests use assisted permissions. Depending on your previous setting, this may increase or reduce the number of approval requests you see during the task.

Further reading

• Allowing and denying tool use
• Running GitHub Copilot CLI programmatically
• GitHub Copilot CLI
• Allowing GitHub Copilot to work autonomously