You want to enable a GitHub Copilot agent to autonomously create a new branch, commit changes to it, and open a pull request — all without human intervention. Which two things must be true for this to work correctly?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Giving an agent the ability to create branches and open PRs is like handing an employee a key card and signing the authority form — you need both. The key card is the token with the right permissions (contents: write to push commits, pull-requests: write to open PRs), and the signed form is the agent configuration that explicitly allows autonomous actions. Either one alone isn't enough: a token without permission to act autonomously, or an agent allowed to act but without the right token scope, both fail.
Full explanation below image
Full Explanation
Enabling autonomous branch creation and pull request submission requires satisfying both the authentication layer (correct token permissions) and the agent configuration layer (explicit enablement of autonomous actions).
Option A is incorrect. admin:repo scope is a classic OAuth scope for GitHub Apps and PATs that confers broad administrative access. Modern best practice (and the GitHub Copilot agent framework) uses fine-grained permissions specified in the workflow or app installation. More critically, disabling branch protection rules on all branches is not a prerequisite — agents can create new branches (which are not protected by default) without touching protection rules on main.
Option B is correct. The GitHub Actions GITHUB_TOKEN (or a GitHub App token) requires fine-grained permissions declared in the workflow: - contents: write — allows creating/updating files, creating branches, and pushing commits via the API - pull-requests: write — allows creating and updating pull requests
Beyond the token, the agent definition must explicitly enable autonomous actions. Without this explicit opt-in, the agent may not have the runtime authorization to perform actions that modify repository state, even if the token technically allows them. This two-layer design prevents accidental or unintended autonomous behavior.
Option C is incorrect. Running as an org owner is not required for branch creation and PR submission. These are standard repository operations available to users and apps with appropriate repository permissions. The runs-on label (self-hosted vs. GitHub-hosted) relates to the runner infrastructure, not to Git permissions or agent authorization.
Option D is incorrect. The scenario explicitly calls for autonomous action without human intervention. Requiring real-time approval defeats the purpose of agent autonomy. Some workflows may include human approval gates as a safety measure, but this is optional and configured at the workflow level — it is not a default requirement for agents to create branches and PRs.
Key point: autonomous actions need both the right token permissions AND explicit agent-level configuration enabling autonomous behavior.