Every agent · Coding agents · GitHub (Microsoft)

GitHub Copilot coding agent

Q: What can GitHub Copilot coding agent act on?

Executes with approval. It works in a cloud sandbox, writes code, runs your CI and opens a pull request under its own identity. A human merges, so the loop is real, but the agent already ran with the repository and workflow permissions of the issue it was assigned.

Q: Is a human in the loop with GitHub Copilot coding agent, and does data leave the tenant?

Human in the loop by default: yes. Data leaves the tenant by default: yes. It acts, but a person approves each action by default; the risk moves to whoever relaxes that setting. Data leaves your tenant to the vendor by default.

It works in a cloud sandbox, writes code, runs your CI and opens a pull request under its own identity. A human merges, so the loop is real, but the agent already ran with the repository and workflow permissions of the issue it was assigned.

executes with approval

acts on

yes

human in the loop by default

yes

data leaves the tenant by default

Repositories it is assigned issues in, GitHub Actions runners, and any secret or package those workflows can reach

reaches by default

What that means for the register

It acts, but a person approves each action by default; the risk moves to whoever relaxes that setting. Data leaves your tenant to the vendor by default. Pasted with only its name it lands as control until an owner is named.

This week

List the repositories where the agent is enabled and check that its workflow token cannot reach production deploy secrets.

What holding it is evidence for

Requirement text and artefacts from a human-verified corpus licensed to Agent Register.

Data leaving the tenant to a model vendor ISO 42001 A.10.3 · ISO 42001 A.4.3 · ISO 42001 A.7.3 · ISO 42001 A.10.2 · EU AI Act Art.10 · EU AI Act Art.25

ISO 42001 A.10.3 Suppliers

Establish a process ensuring that the organization's use of services, products or materials provided by suppliers aligns with its approach to the responsible development and use of AI systems.

Evidence an auditor accepts: supplier assessment criteria covering responsible AI; completed assessments for AI suppliers including model, dataset and component providers; contract terms binding suppliers to the organization's AI requirements

ISO 42001 A.4.3 Data resources

As part of identifying resources, the organization shall document information about the data resources utilized for the AI system.

Evidence an auditor accepts: Data inventory; Data lineage records; Datasheets

ISO 42001 A.7.3 Acquisition of data

The organization shall determine and document details about the acquisition and selection of data used in AI systems, including provenance and consent where applicable.

Evidence an auditor accepts: Data acquisition records; Provenance documentation; Consent records

ISO 42001 A.10.2 Allocating responsibilities

Ensure responsibilities across the AI system life cycle are allocated between the organization, its partners, suppliers, customers and third parties.

Evidence an auditor accepts: RACI or equivalent covering each life cycle stage and each external party; contract clauses that state who is accountable for what; evidence the allocation is reviewed when the arrangement changes

EU AI Act Art.10 Data and data governance

High-risk AI systems that make use of techniques involving the training of AI models shall use training, validation and testing data that meet the quality criteria in Art.10(2)-(5): appropriate data governance, examination for possible biases, identification of data gaps/shortcomings, statistically ...

Evidence an auditor accepts: Data governance procedures; Bias examination records and remediation; Data-quality assessment per dataset

EU AI Act Art.25 Responsibilities along the AI value chain

Distributors/importers/deployers/other third parties become providers when they place on the market or put into service under their own name or trademark, substantially modify the system, or modify the intended purpose making it high-risk. The original provider shall cooperate with the new provider,...

Evidence an auditor accepts: Documented allocation of provider status across the value chain; Cooperation agreements between original and new providers

Do this for every tool your teams use

Paste the list and get this classification for every entry at once, with the owner column, the findings per department, and the controls the register is evidence for. Ten entries free, no account.

Build my agent register

OpenAI Assistants and Agents SDK · GitHub Copilot