Copilot can now let an AI judge approve its own commands, with admin limits

GitHub, part of Microsoft, has made assisted permissions generally available in Copilot CLI, the GitHub Copilot app and Visual Studio Code. A language model now judges Copilot’s requests, and only those it deems clearly safe proceed without a click.

How the model-checked approval works

Copilot regularly asks before it runs a command, touches a file system path or opens a URL. In assisted mode, a large language model evaluates each of those requests. According to GitHub, requests classified as clearly safe go ahead automatically, and everything else still waits for the user’s approval.

Switching it on differs by surface:

• Copilot CLI: run /permissions and choose assisted.
• Copilot app: open the mode picker, click Tool permissions, then pick Assisted.
• Visual Studio Code: open the permissions picker and select Assisted permissions.

The CLI’s 1.0.104 release notes add that assisted permissions no longer require experimental mode there. Until now, then, CLI users had to opt into experimental features to try it.

Admins can cap it or switch it off

The announcement gives enterprise administrators three levers through enterprise-managed settings. They can block the Allow All mode while leaving Assisted available, disable Assisted on its own, and pick the default permission mode for new sessions. Developers can still choose another mode, as long as policy allows it. If the chosen default is unavailable or prohibited, GitHub says the session starts with manual approval.

That fallback matters: a misconfigured policy degrades to the most cautious behavior rather than the most permissive one.

What the announcement leaves open

The page is short, and several things a buyer would ask are missing. It does not say which Copilot plans include assisted permissions, or whether the feature is billed or counts against usage. It does not name the model that makes the call, how often it is wrong, or what “clearly safe” means in practice; GitHub points to a documentation page, “Allowing safe commands to run without manual approval”, for the evaluation rules. It also does not report any testing data, so the safety of the approach rests on GitHub’s description alone.

A second practical gap: the model sees requests that may include commands and URLs, but the announcement does not say how that data is handled or whether the evaluation adds latency to each step.

A familiar bet on classifier-gated autonomy

The design echoes a move by a rival. Anthropic introduced an auto mode for Claude Code as a research preview in March 2026, in which a separate classifier model reviews each action and approves safe ones, according to a MindStudio explainer. That write-up says Claude Code pauses auto mode and goes back to prompting if the classifier blocks an action 3 times in a row or 20 times in a session. GitHub’s announcement describes no comparable circuit breaker, though it may exist in the documentation.

The difference GitHub stresses is governance. Its controls are aimed at organizations that want the speed of fewer prompts without allowing an unrestricted mode, which fits a pattern in its recent admin work. Last week GitHub began applying a default policy to eligible Copilot features that admins had never configured, after a 28-day window to set it. Assisted permissions come with the opposite posture: they can be blocked or capped by policy, and the failure state is manual approval.

For developers, the change is about approval fatigue. Agents that stop for every shell command are slow, and users tend to respond by granting broad access. A middle setting that lets routine requests through and escalates the rest is meant to remove that trade-off. Whether it does depends on classifier accuracy that GitHub has not published, and on a model that, like any, can misjudge a request in a context it cannot see. Teams that adopt it would be wise to keep Allow All blocked and review what the model lets through, particularly for commands that change files or reach the network.