GitHub has added project-level local sandboxing and enterprise-managed OpenTelemetry to the Copilot app, extending its earlier central permission controls.
The control stack at a glance
Short answer: three controls, not one safety guarantee
GitHub's September releases now give buyers three distinct control layers. Enterprise administrators can classify supported shell, file and network operations as denied, approval-required or allowed. The Copilot app can start a local session inside a project-level sandbox. Enterprise-managed OpenTelemetry can export agent traces to compatible monitoring tools. Together they improve prevention and investigation, but none establishes that generated code or every agent action is safe.
Managed permissions still define the minimum boundary
The effective precedence remains deny, then ask, then allow. A managed deny stays blocked even when another source permits the operation. A managed ask requires a fresh approval rather than a saved approval or bypass shortcut. These rules can cover shell commands, read and edit paths and network domains, and they remain the appropriate starting point for destructive commands, sensitive folders and unapproved destinations.
Local sandboxing is useful only after it is turned on
The Copilot app's project settings can add read/write, read-only and denied folders; control outbound internet and local-network access; and decide whether Git and GitHub CLI credentials are available. The sandbox is off by default. A project toggle affects new sessions, while an active local session can use `/sandbox on`. Setting changes take effect on new sessions or after a restart. If the operating system cannot enforce the requested policy, GitHub says the shell fails instead of silently running unsandboxed.
Coverage gaps must stay visible
Local sandbox settings do not apply to cloud sandbox sessions or sessions running on a remote host, and Copilot app and Copilot CLI sandbox settings are configured separately. The feature is a public preview and can change. Teams should therefore inventory every client and execution route rather than assuming one project setting covers VS Code, CLI, remote development and cloud agents.
Telemetry adds evidence, with a content decision attached
Enterprise-managed OpenTelemetry can send session flows, model requests and tool-use traces to compatible monitoring systems for investigation. Prompt and response content is excluded by default. Administrators should decide whether richer capture is necessary, document the privacy and retention effect, restrict the receiving endpoint and verify that the exported spans are sufficient to investigate a failed or unexpected action.
HubAI buyer verdict
The combined control stack is a stronger enterprise buying signal than a single approval prompt, but it is still Test pending. Start with managed denies, enable the local sandbox for one non-production project, keep content capture at its minimum, and run the same repository task across every intended client. Expand only when permissions hold, traces explain failures, accepted changes pass review and rollback works. HubAI is withholding a score until that test is complete.
HUBAI VIEWThe controls are useful, but not automatic: local sandboxing is off by default, applies to new or restarted local sessions and does not cover remote or cloud sandboxes.
Buyer decision signal: Updated · sandbox and observability controls
What to verify next
1Inventory local, remote and cloud sessions instead of assuming one sandbox covers every route
2Map supported operations to deny, fresh approval or allow before rollout
3Enable sandboxing for the pilot project and restart existing sessions after policy changes
4Test denied paths, unknown domains, Git credentials and GitHub CLI credentials in a non-production repository
5Configure the telemetry receiver, retention and access before exporting traces
6Review prompt and response content-capture settings explicitly; content is excluded by default
7Measure accepted changes, reviewer intervention, blocked legitimate work and rollback before increasing autonomy
Read the evidence
Capabilities, availability and prices can change. HubAI keeps analysis separate from the underlying official material.
01GitHub Changelog: enterprise managed permissions for Copilot agent operationsOpen source ↗02GitHub Changelog: local sandboxing in the Copilot app — 23 September 2026Open source ↗03GitHub Changelog: OpenTelemetry in the Copilot app — 22 September 2026Open source ↗04GitHub Copilot weekly release summary — 25 September 2026Open source ↗
Code AI
Code AI
Code AI