policy-and-managed-settings
Installation
SKILL.md
Enterprise Policy and Managed Settings
Route a control by where the governed behavior is implemented, not by who requested it. Most Copilot agent controls belong in the runtime, not VS Code.
| Governed behavior | Destination | Guide |
|---|---|---|
| Copilot runtime: tools, shell, files, URLs, MCP, plugins, subagents, permissions, sandbox, runtime model/telemetry | Runtime managed setting (SDK type only if the host owns the value) | sdk-runtime-policy.md |
| VS Code editor/workbench | VS Code configuration policy: |
vscode-policy.md |
| Extension-contributed setting | extensionConfigurationPolicy in vscode-distro |
extension-policy.md |
| Independent runtime and editor behavior | Split: runtime setting for agent behavior, VS Code policy for editor behavior only | both of the above |
| Existing permission policy introduced before 1.133 | Bounded migration only | legacy-permission-policy.md |
Supporting references:
- github-managed-settings.md: projecting managed settings into VS Code policy (channels, precedence, key declaration).
- policy-support-maintenance.md: Agent Host support inventory and Policy Diagnostics readiness.
- local-testing.md: mock policy server.