The safeguards map / 3.2 Agent harnesses
GitHub Copilot cloud agent and CLI
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
GitHub's coding agents. The CLI asks before each tool use, and the cloud agent works on a restricted branch behind a firewall, with human review before merge.
Where it sits
3.2 Agent harnesses (primary): Asks the user to approve tool use in the CLI session, and confines the cloud agent to its own branch, an internet firewall and human review before merge.
Option 1 allows Copilot to run this particular command, this time only.
captured
Draft pull requests created by Copilot cloud agent must be reviewed and merged by a human.
captured
the agent can only push to that branch
captured
By default, Copilot's access to the internet is limited by a firewall.
captured
Facts
- Concern
- safetysecurity
- Names the law
- no
- Subject
- agent
- Used by
- those who run it
- Runs
- at runtime
- Policy comes from
- vendor defaultsowner-entered settings
- Can the agent bypass it
- depends
Handoffs
None recorded.
Listed, not drawn: no documented handoff and no foundation home places it on the map.
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.