# GitHub Makes Agentic Workflows Generally Available with Isolation and Budget Controls > Source: > Published: 2026-11-11 17:00:00+00:00 GitHub has made GitHub Agentic Workflows generally available. The open-source project runs coding agents inside GitHub Actions for repository tasks such as issue triage and continuous integration (CI) failure analysis. Agents start with read-only permissions, and any changes they propose are applied by separate jobs that hold their own write tokens. That separation has limits. The project's [FAQ](https://github.github.com/gh-aw/reference/faq/) says the protections do not automatically extend to direct write permissions or to custom jobs a workflow author adds, so the safety of a workflow depends on how it is configured. Authors can also add a GitHub Environment protection rule to require a reviewer before a write job runs. Developers describe the work in natural-language Markdown, with YAML frontmatter for configuration. The project compiles that definition into a standard Actions workflow, which reuses existing runner groups and policy constraints, and teams can use Copilot or bring another coding agent. According to the [general availability announcement](https://github.blog/changelog/2026-10-28-github-agentic-workflows-generally-available), agents run in a sandboxed container behind the Agent Workflow Firewall, and a threat-detection job scans proposed changes before they are applied. The project entered public preview in June 2026. Since the preview, GitHub has added support for [Actions Runner Controller](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/about-actions-runner-controller) (ARC), its Kubernetes operator for self-hosted runners, with [Docker-in-Docker](https://github.github.com/gh-aw/guides/arc-dind-copilot-agent/) (DinD). DinD runs a Docker daemon inside the runner pod so the agent can start its sandbox containers. The project's guide notes that ARC runs the DinD sidecar as a privileged container by default, a privileged component sitting alongside an agent designed around least privilege. Spending is capped by default. GitHub's [documentation](https://docs.github.com/en/copilot/concepts/agents/about-github-agentic-workflows) prices AI Credits (AIC) at $0.01 each and sets a cap of 1,000 AIC ($10) per run. The project's [enterprise controls reference](https://github.github.com/gh-aw/reference/compiler-enterprise-environment-controls/) adds defaults of 5,000 AIC a day, 400 AIC per threat-detection run and a 20-minute timeout on the agent step, all of which organisations can override. The `gh aw forecast` command, no longer experimental, estimates monthly AI credit spending, including threat detection. In the announcement, Ben Alton, senior manager in Accenture's Strategy, Architecture & Innovation team, said: "One of our leads saved an estimated 29 hours a week on his development work alone." The announcement does not explain how that figure was measured. Engineers testing the project have taken a more cautious line. In a [walkthrough of an issue-triage workflow](https://dev.to/sascha-ms/github-agentic-workflows-issue-triage-step-by-step-48p7), Sascha Mirow-Stanitzok, team lead for middleware at freenet, judged the default budget far too generous for triage and capped his runs at 100 AIC, 15 turns and 10 minutes. He also wrote that telling the agent to ignore instructions in issue text does not protect a workflow by itself, and said he would not use the same pattern for workflows that change code or open pull requests. GitLab takes a different route with its [Duo Agent Platform flows](https://docs.gitlab.com/user/duo_agent_platform/flows/), which run on runners under a [composite identity](https://docs.gitlab.com/user/duo_agent_platform/security/) that pairs a service account performing the actions with the human user who started the request. Its [triggers](https://docs.gitlab.com/user/duo_agent_platform/triggers/), such as a mention or an assignment, must come from a human user, so one flow cannot start another. That rule stops agents from chaining work across flows without a person starting it. GitHub's FAQ says conventional Actions remain the right choice for reproducible builds and tests, with agent workflows suited to tasks that need interpretation or generation. The project is available on GitHub Free, Team and Enterprise on [github.com](http://github.com), and the default Copilot CLI engine requires a Copilot licence.