Copilot/Guarded actions

Guarded actions

Propose, confirm, execute — the Copilot never goes straight to execute.

The Copilot can do things, not only read. Every one of those goes through the same three steps.

Propose → confirm → execute

text

1. PROPOSE   the Copilot describes exactly what it would do
2. CONFIRM   a human reads it and agrees
3. EXECUTE   it happens, and is audited

There is no path that skips step 2. Not for a trusted user, not for a low-risk action, not with a setting.

Important

The reason is not that the model is unreliable at proposing. It is that a confirmation step is the only thing that makes the proposal readable — and an action nobody read is an action nobody can be accountable for.

What it can propose

Action
File writes	In the sandboxed workspace only
Configuration changes	Rules, thresholds, routing
Ticket creation	Where an integration allows it

The file workspace

Off unless COPILOT_WORKSPACE_DIR is set.


Scope	One directory. Nothing outside it
Reads	Ordinary tools
Writes	Propose → confirm → execute
Extensions	`COPILOT_WORKSPACE_EXTENSIONS`
Size	`COPILOT_WORKSPACE_MAX_FILE_KB`

Reading a proposal

The proposal shows the exact change — a diff for a file, the before and after for a setting.

Warning

Read the diff, not the summary. The summary is the Copilot's description of its own change and is written before the change is applied; the diff is the change.

Auto-triage and gating

For endpoint guard verdicts there are two modes:

Mode
`shadow`	Records the verdict, does not act
`gate`	A "not real" verdict suppresses the alert

gate is the one exception to "a human confirms", and it only ever suppresses — it cannot create an alert or take an action.

Caution

Run shadow for a meaningful period first, and read the audit log — including the cases it let through. A suppression you disagree with is a page that never happened, and it leaves no trace in the alert history.

Audit

Every proposal, confirmation and execution is recorded with who confirmed it. See Audit log.

Where this behaviour lives: backend/internal/service/copilot_svc.go, backend/internal/integration/copilot_files.go. If the code and this page disagree, the code is right — please fix the page.

Part of Copilot — The assistant that can read your monitoring data and act on it.