Updated Oct 20

Share this article

Related News

Anthropic Engineer Warns AI Coding Leads to Cognitive Surrender

Nov 8, 2026

Anthropic Engineer Warns AI Coding Leads to Cognitive Surrender

Anthropic Claude Code engineer Addy Osmani is sounding the alarm on what he calls cognitive surrender — the risk that developers who hand too much coding work to AI agents lose the very skills needed to supervise them. His warning is backed by Anthropic's own randomized controlled trial showing AI-assisted developers scored 17% lower on comprehension tests. For builders who use AI coding tools daily, the message is clear: use AI to learn, not just to produce.

cognitive surrenderai codingclaude code

Microsoft’s Copilot harness comes to Foundry for managed agent execution

Oct 29, 2026

Microsoft’s Copilot harness comes to Foundry for managed agent execution

Microsoft’s October 28 announcement separates the model from its instructions, context, execution and controls, with managed Foundry and downloadable SDK routes.

MicrosoftMicrosoft FoundryGitHub Copilot

GitHub Copilot adds server authentication with a billable read-only permission

Oct 28, 2026

GitHub Copilot adds server authentication with a billable read-only permission

Organization-installed GitHub Apps can now use Copilot without a signed-in user. The preview uses one-hour tokens, organization-wide spending controls and CSV app attribution, with no per-app budget.

GitHub CopilotCopilot SDKGitHub Apps

GitHub’s Copilot model policy API turns model access into auditable configuration — Source: OpenTools Team / original Copilot model policy now has an API control plane evidence mapSource image

Copilot Governance

GitHub’s Copilot model policy API turns model access into auditable configuration

By OpenTools TeamOctober 20, 2026

GitHub now exposes generally available GET and PATCH endpoints for Copilot model policies at enterprise, team, app and organization levels. The API can reduce manual drift, but delegation mode, current state and rollout verification still decide which models users can select.

Four policy endpoints are now generally available

GitHub’s October 19 changelog says administrators can now retrieve and update Copilot model policies through REST endpoints for enterprises, enterprise teams, enterprise apps and organizations. The release moves a control that often lives in a settings screen into versionable automation.

The four levels matter because they do not describe four copies of the same switch. An enterprise can keep control centrally, delegate to organizations, or use a mode that delegates to teams and apps. The effective setting therefore depends on both the value returned by the endpoint and the governance mode above it.

A useful inventory stores the resource, model identifier, returned state, delegation mode and read time together. Recording only a boolean can hide that a team-level setting is being overridden or has never been delegated.

A guarded update starts with a fresh read

The safe sequence is read, compare, change and read again. First fetch the current policy at the exact resource level. Compare it with the reviewed desired state and stop if the hierarchy or current value differs from what the change expected.

Then send the narrow PATCH and retain the request body, response, actor and timestamp. Finally, retrieve the policy again and confirm that the effective state matches the intended model list. A successful HTTP response establishes that GitHub accepted a request; it does not by itself prove that the intended users can select the model.

For staged rollout, begin with one team or app whose workflows are known. That keeps the blast radius smaller than an enterprise-wide write and makes it easier to separate policy errors from model behavior changes.

Model availability is also a migration dependency

The policy API arrived on the same date that GitHub removed several older Copilot models. That makes availability configuration part of release management: a recommended replacement can still be unavailable if the relevant policy does not enable it.

Teams should map repositories and automation to the models they actually select, then verify that each replacement is permitted before the old choice disappears. For interactive Copilot use, GitHub says administrators can confirm the enabled model in settings and users can verify it appears in the model selector.

The API can automate the policy check, while a real selector or supported inventory read confirms the user-facing result. Neither check proves output quality for a particular codebase, so migration tests still need representative tasks.

Treat the policy file as a change-controlled security artifact

Model access can affect data routing, feature availability, cost and the behavior of agentic workflows. The policy deserves the same review discipline as other production configuration: named owner, least-privilege token, expected current state, reversible scope and an audit trail.

Avoid a script that blindly rewrites every organization on a timer. It can erase an intentional local exception or re-enable a model that a team disabled after a defect. Reconcile only resources within the script’s ownership and surface mismatches for review.

The new API is valuable because it makes policy observable and repeatable. Its strongest use is a narrow control loop that proves the hierarchy and effective result, not a bulk write that assumes every Copilot group should share one model set.

Figure by OpenTools Team; no third-party expressive material used. It maps GitHub’s four scopes to a guarded read-change-read rollout.

Sources

1.github.blog (github.blog)
2.docs.github.com (docs.github.com)

Tags

GitHub Copilotmodel governanceREST APIenterprise AI developer tools