GitHub Copilot: Expert

Expert

The expert move is to stop watching Copilot work. You hand it a well-specified task, it runs asynchronously in the cloud, and you review a pull request, the same as you would for a teammate. The work shifts to specification, orchestration, and governance.

The autonomous cloud coding agent

The cloud coding agent is the CI-native path. Assign a GitHub issue (from GitHub.com, the mobile app, or gh on the CLI) and the agent works in a GitHub Actions sandbox, then opens a draft PR with a task checklist you review before merging.

1. Write a clear, well-scoped issue: acceptance criteria, constraints, files to touch.

2. Assign it to Copilot.

3. The agent branches, works in its sandbox, and pushes commits to a draft PR.

4. Review the diff and checklist like any other PR before merging.

A sharp issue is the whole game here. The agent is only as good as the specification you hand it. This is a reliable workflow applied to async work.

Caution

The cloud agent does not honor content-exclusion rules. It gets full checkout access, including excluded paths. Don’t assign it issues that touch secrets you thought were excluded. And its PR is a draft for a reason: review it like a junior engineer’s work, not a finished result.

Run work in parallel

The cloud agent runs multiple issues at once, each in its own sandbox. In VS Code, the Agents window opens several sessions side by side. Orchestration is mostly about scoping work into independent units that don’t collide, and reviewing each result. Custom .agent.md agents with handoffs let one agent pass work to another.

Memory and its limits

Copilot Memory stores repo-level facts (conventions, build commands, project rules) and user preferences, used by the cloud agent, code review, and CLI. Know its limits:

• Only users with write access create repo facts; repo owners (and org/enterprise admins on Business/Enterprise) can review and delete them.
• Any fact or preference that goes unused is auto-deleted after 28 days; the timer resets when a memory is validated and used.
• Session memory (plan.md) is wiped when the conversation ends.

Neither is a durable knowledge store. For anything that must persist, keep it in your instruction files and the repo itself.

Govern it across the org

On Business and Enterprise, admins set the guardrails. This is where a Swiss SME rollout lives or dies.

Control	What to set
AI-Credit budgets	Cap spend before rollout: billing is usage-based since 1 June 2026, and larger context windows cost more credits
Content exclusions	Hide sensitive paths (respected by completions and code review, not by agent mode or the cloud agent)
MCP registry allowlist	”Registry only” instead of “Allow all”
Org-level instructions	Enable github.copilot.chat.organizationInstructions.enabled
Duplication/matching filter	Required for the IP Indemnification Commitment
Training	Business/Enterprise guarantee that prompts and suggestions are not used to train models

Two of these land as concrete VS Code settings you can pin in a shared baseline (checked-in .vscode/settings.json or centrally managed settings):

settings.json

{
  // Pull in custom instructions defined at the org level
  "github.copilot.chat.organizationInstructions.enabled": true,

  // Agent mode: auto-approve only known-safe terminal commands
  "chat.tools.terminal.autoApprove": {
    "npm test": true,
    "/^git (status|diff|log)\\b/": true,
    "rm": false,
    "/curl|wget/": false
  }
}

true entries auto-approve (exact commands or /regex/ patterns); false entries always require manual approval, and a command is only auto-approved if every subcommand matches a true rule and none matches a false rule. Setting names and defaults move with VS Code releases, so verify against the current VS Code agent-mode docs before rolling out.

Caution

For a Swiss or EEA client, confirm data-residency and DPA specifics against the GitHub Trust Center for that exact tenant before you advise. Don’t assume EU/Swiss data handling from the plan name.

The tool is an accelerator with no opinion about direction. At org scale, governance and a clear specification are the steering. The teams that win are the ones that use it right, not the ones that use it most.

You’re done when…

• ✅ You’ve shipped a change by assigning an issue to the cloud coding agent and reviewing its draft PR
• ✅ You understand what Copilot Memory does and doesn’t persist
• ✅ You’ve set the org guardrails: AI-Credit budgets, content exclusions, the MCP allowlist, and the duplication filter

Next step

You’ve reached the top of the Copilot track. The fundamentals carry across every tool.

Foundations: Context engineering The craft that carries across every tool.

Start here Pick another tool track.