Your team's GitHub Copilot agent needs read access to repository contents but must not be able to write to branches or create pull requests. How should tool permissions be configured?
Select an answer to reveal the explanation.
Short Explanation and Infographic
A night security guard gets a key to the building, not the keys to every safe inside. Principle of least privilege means the agent only gets the permissions it needs to do its job — nothing more. Disabling write tools at the configuration level enforces this at the system level, not just the model level.
Full explanation below image
Full Explanation
Tool permissions in GitHub Copilot agents should be configured according to the principle of least privilege: grant only the minimum permissions required for the agent's intended function. This is enforced at the tool configuration level, not left to the model's discretion.
Why B is correct: Explicitly enabling only read-scoped tools (file read, code search) and disabling write-scoped tools (branch creation, PR creation, file write) ensures the agent cannot perform write operations regardless of what the model 'decides.' This is an architectural enforcement, not a behavioral one.
Why A is wrong: Relying on the model's judgment to avoid write operations is not a reliable control. Models can be prompted or manipulated into performing operations they were not intended to perform. System-level permission controls must be used instead.
Why C is wrong: Temporary permission grants that are revoked after each run are operationally complex and error-prone. If the revocation fails or is delayed, the agent retains elevated permissions. Static least-privilege configuration is simpler and safer.
Why D is wrong: While audit logs are important for accountability, they are a detective control, not a preventive one. Audit logs capture what happened after the fact — they do not prevent unauthorized write operations from occurring.