Support default-deny tool permissions with explicit allowlist in non-interactive mode #5275

Activity

1. ferdoesi

   added the

   Feature

   issue type on Oct 28, 2026
2. ferdoesi

   added

   triage

   on Oct 28, 2026
3. ronaldmaguling-del commented on Oct 28, 2026

   

   ronaldmaguling-del

   on Oct 28, 2026

   More actions

   Describe the feature or problem you'd like to solve

   Non-interactive mode cannot enforce a strict tool allowlist because --deny-tool always overrides --allow-tool and some tools are allowed by default.

   Currently, GitHub Copilot CLI does not provide a straightforward way to enforce a strict tool allowlist in non-interactive mode.
   Some tool invocations, such as read-only shell commands, are allowed by default. Since --deny-tool rules always take precedence over --allow-tool rules, it is not possible to deny a tool broadly while explicitly allowing specific invocations.

   For example, the following configuration does not work as intended:

   copilot --deny-tool='shell' --allow-tool='shell(path/to/script)'

   This limits the ability to enforce least-privilege execution policies in automated workflows, such as CI/CD pipelines, where tool execution must be restricted without relying on interactive approval.

   Proposed solution

   Introduce a default-deny permission mode for non-interactive execution, in which all tool invocations are denied unless explicitly permitted through allow rules, including tools and commands normally allowed by default.

   Ideally, this should integrate with the existing permission mechanisms and apply consistently across subagents.

   This would make unattended runs more secure and predictable, remove the need for custom hooks, and make it easier to adopt Copilot CLI in CI/CD and security-sensitive environments.

   Example prompts or workflows

   A CI/CD pipeline runs Copilot CLI in non-interactive mode. Copilot should be permitted to execute a specific validation script (path/to/script) while all other shell commands, including read-only commands, are denied.

   Additional context

   A workaround for this feature is possible using preToolUse hooks, but this requires custom permission-checking logic and additional safeguards against bypasses, such as modifying hook scripts or configurations, or delegating execution to subagents.

   Native support would simplify configuration and provide a more reliable way to enforce least-privilege policies in unattended environments.
4. copilot-cli-bot

   added

   area:non-interactiveNon-interactive mode (-p), CI/CD, ACP protocol, and headless automationNon-interactive mode (-p), CI/CD, ACP protocol, and headless automation

   area:permissionsTool approval, security boundaries, sandbox mode, and directory restrictionsTool approval, security boundaries, sandbox mode, and directory restrictions

   and removed

   triage

   on Oct 29, 2026