--- title: The GitHub Copilot CLI Permission Model: What It Can and... description: A practical guide to the GitHub Copilot CLI permission model covering all major control layers: trusted directories, tool approvals (yes/session/no), allow and... canonical: https://daily.dev/posts/the-github-copilot-cli-permission-model-what-it-can-and-can-t-touch-zi92ba4sn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The GitHub Copilot CLI Permission Model: What It Can and Can't Touch | daily.dev og:description: A practical guide to the GitHub Copilot CLI permission model covering all major control layers: trusted directories, tool approvals (yes/session/no), allow and... og:url: https://daily.dev/posts/the-github-copilot-cli-permission-model-what-it-can-and-can-t-touch-zi92ba4sn og:image: https://api.daily.dev/og/posts/ZI92BA4sN.png og:image:alt: The GitHub Copilot CLI Permission Model: What It Can and Can't Touch og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The GitHub Copilot CLI Permission Model: What It Can and Can't Touch **[We Are .NET](https://daily.dev/sources/wearedotnet)** · 17 min read · 1 upvotes · 0 comments ## Summary A practical guide to the GitHub Copilot CLI permission model covering all major control layers: trusted directories, tool approvals (yes/session/no), allow and deny flags, path permissions, URL access controls, preToolUse hooks for policy enforcement, sandboxing options (local and cloud, both in preview as of July 2026), and secret redaction with --secret-env-vars. Key takeaways include: deny flags override allow flags, session-wide tool approval is broader than most developers assume (approving 'rm' once allows all rm commands), --allow-all and --yolo are aliases that disable all restrictions, and trusted directories are heuristic guardrails not cryptographic boundaries. Includes concrete CLI examples and a recommended 'start narrow, add what is needed' permission philosophy. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What happens if I approve the rm tool for the rest of a GitHub Copilot CLI session? Approving rm for the session lets Copilot run any rm command afterward without asking again, including something as destructive as rm -rf ./*. GitHub's documentation calls this out explicitly because session approval switches you from approving one command to approving an entire tool category for the remainder of the session. _Anyone scripting agent permissions can compare notes on safe defaults for destructive commands via daily.dev._ ### Is --yolo the same as --allow-all in GitHub Copilot CLI? Yes, GitHub documents --allow-all and --yolo as equivalent aliases that combine --allow-all-tools, --allow-all-paths, and --allow-all-urls, removing tool, path, and URL restrictions simultaneously. This is convenient for disposable sandboxes and throwaway prototypes but risky on a real workstation containing credentials or deploy scripts. _Developers weighing agent trust levels can track flag behavior changes like this through daily.dev._ ### Does --deny-tool take precedence over --allow-tool in GitHub Copilot CLI? Yes, deny rules always win over allow rules, including --allow-all-tools. This lets a workflow allow a broad set of tools for convenience while still explicitly blocking specific foot-guns such as shell(rm), shell(git push), or shell(git clean), giving a controlled middle ground between full restriction and full access. _Teams designing agent guardrails can keep up with permission flag semantics on daily.dev._ ## Similar posts on daily.dev - [GitHub Copilot CLI Tips & Tricks — Part 4: Automating and enforcing policies with hooks](https://daily.dev/posts/github-copilot-cli-tips-tricks-part-4-automating-and-enforcing-policies-with-hooks-ucqhydtbd) · The Art of Simplicity · 0 upvotes · 0 comments - [Local sandboxing in the GitHub Copilot app](https://daily.dev/posts/local-sandboxing-in-the-github-copilot-app-9czmuyxaf) · GitHub Changelog · 0 upvotes · 0 comments - [GitHub Copilot CLI for Beginners: Getting started with GitHub Copilot CLI](https://daily.dev/posts/github-copilot-cli-for-beginners-getting-started-with-github-copilot-cli-pxlsfvyjv) · GitHub Blog · 3 upvotes · 0 comments - [GitHub Copilot CLI Reaches General Availability](https://daily.dev/posts/github-copilot-cli-reaches-general-availability-kwflfu4u5) · InfoQ · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#ai-agents](https://daily.dev/tags/ai-agents), [#cli](https://daily.dev/tags/cli) [View this post on daily.dev](https://daily.dev/posts/the-github-copilot-cli-permission-model-what-it-can-and-can-t-touch-zi92ba4sn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The GitHub Copilot CLI Permission Model: What It Can and Can't Touch","url":"https://daily.dev/posts/the-github-copilot-cli-permission-model-what-it-can-and-can-t-touch-zi92ba4sn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-github-copilot-cli-permission-model-what-it-can-and-can-t-touch-zi92ba4sn"},"datePublished":"2026-07-21T12:26:32.606Z","dateModified":"2026-09-14T07:51:14.705Z","description":"A practical guide to the GitHub Copilot CLI permission model covering all major control layers: trusted directories, tool approvals (yes/session/no), allow and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/78fa7aab494004ba6010dfdf7d790840?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/78fa7aab494004ba6010dfdf7d790840?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"We Are .NET","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"We Are .NET","logo":"https://media.daily.dev/image/upload/s--BsnVOa3i--/f_auto/v1718347410/logos/wearedotnet","url":"https://daily.dev/sources/wearedotnet"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-github-copilot-cli-permission-model-what-it-can-and-can-t-touch-zi92ba4sn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,github,ai-agents,cli","timeRequired":"PT17M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"We Are .NET","item":"https://daily.dev/sources/wearedotnet"},{"@type":"ListItem","position":3,"name":"The GitHub Copilot CLI Permission Model: What It Can and Can't Touch"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-github-copilot-cli-permission-model-what-it-can-and-can-t-touch-zi92ba4sn#faq","mainEntity":[{"@type":"Question","name":"What happens if I approve the rm tool for the rest of a GitHub Copilot CLI session?","acceptedAnswer":{"@type":"Answer","text":"Approving rm for the session lets Copilot run any rm command afterward without asking again, including something as destructive as rm -rf ./*. GitHub's documentation calls this out explicitly because session approval switches you from approving one command to approving an entire tool category for the remainder of the session. Anyone scripting agent permissions can compare notes on safe defaults for destructive commands via daily.dev."}},{"@type":"Question","name":"Is --yolo the same as --allow-all in GitHub Copilot CLI?","acceptedAnswer":{"@type":"Answer","text":"Yes, GitHub documents --allow-all and --yolo as equivalent aliases that combine --allow-all-tools, --allow-all-paths, and --allow-all-urls, removing tool, path, and URL restrictions simultaneously. This is convenient for disposable sandboxes and throwaway prototypes but risky on a real workstation containing credentials or deploy scripts. Developers weighing agent trust levels can track flag behavior changes like this through daily.dev."}},{"@type":"Question","name":"Does --deny-tool take precedence over --allow-tool in GitHub Copilot CLI?","acceptedAnswer":{"@type":"Answer","text":"Yes, deny rules always win over allow rules, including --allow-all-tools. This lets a workflow allow a broad set of tools for convenience while still explicitly blocking specific foot-guns such as shell(rm), shell(git push), or shell(git clean), giving a controlled middle ground between full restriction and full access. Teams designing agent guardrails can keep up with permission flag semantics on daily.dev."}}]} ```