Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Security and enterprise docs overstate policy enforcement for Copilot harness sessions (ChatAgentMode, ChatMCP, network filter, tool approval)

Open
  • Is something wrong?
#10,489 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@alok-108 is already working on this.

Since Oct 15, 2026.

  • #10491 by @alok-108 — open

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
18/100
Issue type
Documentation
Clarity
Mostly clear
Activity status
Stale
Tech stack
markdown, typescript
Domain
documentation, security

Research direction

Start with the "Enterprise policies" section of docs/agents/run/security.md (around lines 213-218) and the policy notes in docs/enterprise/manage-ai-settings.md (around lines 175, 228, 298, 302, 332), then compare them with the partial-support entries in agentHostPolicySupport.ts. Done means the absolute wording is qualified per harness, and each affected policy has a note like the existing ChatHooks one. Linked PR #10491 is already open against this issue, so check it before starting.

Written by the indexing model from the issue text.

Description

Summary

The security and enterprise docs present several VS Code device policies as complete controls. Copilot harness (Agent Host) sessions enforce these policies only partially. Two VS Code sources say so: its own policy coverage inventory, agentHostPolicySupport.ts, at 1.142.0, and open microsoft/vscode issues. The docs don't mention these gaps, so an admin who follows them can believe a control is in place when Copilot harness sessions bypass it.

The published pages (security, manage AI settings) and vnext contain the same text.

Docs claim vs. Copilot harness behavior in 1.142
Docs say Copilot harness status in agentHostPolicySupport.ts Tracking
security.md#L213: "Prevent the use of agent mode entirely with the ChatAgentMode policy." See also manage-ai-settings.md#L175-L177. partial: "Blocks the Agents window. In the editor it only switches the chat mode; Agent Host session targets remain available." "Not yet tracked" (source comment)
security.md#L215: "…or disable MCP support completely (off) with the ChatMCP policy." partial: "independent runtime discovery does not consult VS Code MCP access." microsoft/vscode#328241 (open since July)
security.md#L217 and manage-ai-settings.md#L298: ChatToolsEligibleForAutoApproval forces manual approval for individual tools. partial: "does not force per-tool confirmation in other approval modes." microsoft/vscode#337540: "assisted approval and saved session approvals can still auto-approve them"
security.md#L218 and manage-ai-settings.md#L302: ChatToolsTerminalEnableAutoApprove set to false requires approval for terminal commands. partial: custom terminal tools' approval paths "still need a parity audit." None found
manage-ai-settings.md#L332-L336: "Network filtering applies to the fetch tool and Integrated Browser." partial for ChatAgentNetworkFilter, ChatAgentAllowedNetworkDomains, and ChatAgentDeniedNetworkDomains: "native SDK sandboxing ignores them, and the permissions bridge does not translate allowlists." microsoft/vscode#337539: "the runtime's web_fetch bypasses it: unlisted domains prompt, and under Allow All they are fetched silently." Also microsoft/vscode#337538
Why this matters
  • The same file describes the Copilot harness as "the candidate default replacement for Local". It is already a Session Target that users can pick in the editor. VS Code also moves Local sessions to it automatically when managed sandbox or permission settings apply (manage-ai-settings.md#L94-L97).
  • Network allowlist: An organization might set ChatAgentNetworkFilter: true with ChatAgentAllowedNetworkDomains: ["github.com"] to prevent data exfiltration. In a Copilot harness session with Allow all, web_fetch to an unlisted domain succeeds without a prompt (microsoft/vscode#337539).
  • Agents off: An organization might set ChatAgentMode to false to turn off agents. The policy blocks the Agents window (OPEN_AGENTS_WINDOW_PRECONDITION). But the editor's Session Target picker (sessionTargetPickerActionItem.ts) and its availability check (sessionTypeAvailability.ts) don't check chat.agent.enabled. Agent Host sessions remain available there.
  • The docs already handle a similar gap well for hooks. manage-ai-settings.md#L228 says ChatHooks "does not apply to Copilot harness sessions". The policies above don't have an equivalent note.
Suggested fix
  1. In the "Enterprise policies" section of security.md, drop the absolute wording ("entirely", "completely", "Force") or qualify it per harness.
  2. In manage-ai-settings.md, add harness notes like the existing ChatHooks note for ChatAgentMode, ChatToolsEligibleForAutoApproval, ChatToolsTerminalEnableAutoApprove, and network filtering. Where the source names a Copilot managed setting for Agent Host enforcement, point to it.
  3. Consider a "Policy coverage by harness" table. agentHostPolicySupport.ts lists a status for every policy in policyData.jsonc, and the build fails when one is missing, so the table could be generated from it the same way the policy reference is.
How this was checked
  • microsoft/vscode at e9eaf94 (1.142.0): agentHostPolicySupport.ts, the Session Target picker and availability code, and OPEN_AGENTS_WINDOW_PRECONDITION.
  • Linked microsoft/vscode issues #328241, #337538, #337539, and #337540, all open.
  • Docs at main@54f9a67, the live code.visualstudio.com pages, and vnext all have the same text.
  • No existing vscode-docs issue or open PR covers this.
Dominant language
Markdown
Stars
6.7k
Forks
5.8k
Avg merge
9h 7m
Merged PRs (30d)
117

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from microsoft/vscode-docs

All issues in microsoft/vscode-docs

Similar issues

More Documentation issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.