Scope Guard

Scope Guard is a Copilot-native way to reduce blast radius. It combines explicit file ownership, prompt-level boundaries, and approval checkpoints so the agent treats one area as writable and everything else as read-only unless you reopen the scope.

Why This is Copilot-Exclusive

Copilot CLI now has native preToolUse/postToolUse hooks that can allow/deny tool calls (see guides/hooks-to-github-actions.md), but scope-guard is still the right pattern when you want a boundary enforced through the planning/approval flow itself rather than a separate hook script. It combines several useful primitives:

• Plan Mode approval before execution starts
• Task delegation where each agent gets its own brief
• Prompt-scoped ownership for exact paths, files, and stop conditions

This skill packages those primitives into a repeatable guardrail pattern for risky or tightly scoped work.