# GitHub Copilot Enterprise Agent Permissions: Lock Down Shell Access Now

> Source: <https://byteiota.com/github-copilot-enterprise-agent-permissions-lock-down-shell-access-now/>
> Published: 2026-09-14 12:08:28+00:00

GitHub shipped enterprise managed permissions for Copilot agent operations on September 9. Until now, Copilot Business and Enterprise admins had two real choices for agent mode: let it run, or turn it off. That’s no longer good enough. Admins can now block shell commands, require approval for file writes, and lock down outbound network access — and users cannot override any of it, not with workspace settings, not with auto-approval, not with previously saved approvals.

## What Got Locked Down

Managed permissions cover three operation categories: shell commands, file reads and edits, and network domains. For each category, admins choose one of three enforcement tiers:

- **Block** — the operation is denied, full stop
- **Require approval** — the agent pauses and a human must greenlight the action
- **Allow without prompt** — operations proceed automatically

These settings apply across the [GitHub Copilot app, Copilot CLI, and VS Code Agent Host sessions](https://github.blog/changelog/2026-09-09-enterprise-managed-permissions-for-github-copilot-agent-operations/). They are generally available for Copilot Business and Copilot Enterprise customers as of September 9, 2026.

## How to Configure It

Governance lives in `copilot/managed-settings.json` inside your enterprise’s `.github-private` repository — version-controlled, auditable, and deployable like any infrastructure config. The key property:

```
{
  "permissions": {
    "disableBypassPermissionsMode": { "overridable": "disable" }
  },
  "allowedMcpServers": {
    "overridable": [{ "serverUrl": "https://mcp.yourcompany.com/*" }]
  }
}
```

Setting `disableBypassPermissionsMode` to `disable` is the enforcement lever that prevents users from toggling bypass back on. Without it, the rules are guidance. With it, they are enforceable policy. The full [enterprise managed settings reference](https://docs.github.com/en/enterprise-cloud@latest/copilot/reference/enterprise-administrators/enterprise-managed-settings) documents every supported key.

## Why This Was Overdue

This is not a theoretical governance concern. [CVE-2026-29783](https://github.com/advisories/GHSA-g8r9-g2v8-jv6f) proved the risk is real: Copilot CLI versions up to and including 0.0.422 allowed arbitrary code execution through bash parameter expansion patterns like `${var@P}` that the tool misclassified as read-only. An attacker who could influence the agent’s input — via a malicious repository file, a compromised MCP server response, or a crafted user instruction — could run anything. CVSS: 7.5. The binary fix landed in 0.0.423, but patching one exploit does not stop the next one of the same shape. Managed permissions add the policy layer above the vulnerability layer.

Shell access is an agent’s most powerful capability — and its most dangerous. An agent authorized to run shell commands is functionally equivalent to a user with `sudo`. Most enterprises were either blocking agent mode entirely or running with no guardrails. Neither is a real solution.

## JetBrains: Sandbox Controls in Preview

Alongside the GA permissions release, GitHub put enterprise-managed sandbox controls for Copilot in JetBrains IDEs into [public preview on September 8](https://github.blog/changelog/2026-09-08-enterprise-managed-sandbox-in-copilot-for-jetbrains/). Admins can govern sandbox enablement, filesystem and network access, proxy settings, developer-tool access, and macOS Keychain access. A new policy diagnostics tool lets admins verify that settings are actually enforced on developer machines — not just configured and never checked.

## Act Before September 28

There is a deadline. On September 28, GitHub merges Copilot Chat on github.com, Copilot Mobile, and the cloud agent into a single unified experience. Chat history shifts from 28-day deletion to lifetime retention. Code review defaults change from Lite to Balanced. Three separate policies collapse into one.

If you want Lite review to stay the default, set it explicitly before September 28. If you want agent permission policies in place before the unified experience rolls out — and you should — configure `managed-settings.json` this week. A reasonable starting baseline: block outbound network access to non-allowlisted domains, require approval for shell commands, and allow file reads within the project workspace. That gives you real protection without killing the usefulness that made agent mode worth adopting.