Both controls shipped switched off
A vendor shipped a sandbox that narrows what a coding agent can touch, and a trace that carries every tool call and none of the words.
How we Build
The sandbox stops the session rather than running without one
GitHub shipped local sandboxing to its Copilot app on 23 September. A project names the folders an agent may write to, the ones it may only read, and the ones it may not touch at all. Outbound internet and the local network are separate switches, and Git and GitHub CLI credentials are handled on their own. Where the operating system cannot enforce the policy the shell fails with an error instead of running unsandboxed. It is off by default and in public preview.
We tell a client that a coding assistant should be the last thing they reach for, and that it must not be able to touch anything its user could not.
Reach for an agent last, and give it no more reach than the person who asked.
Until this week the assistant held whatever the developer held. Narrowing it broke the tool. GitHub has now built that narrowing into the operating system, and chosen to fail closed where the policy cannot be applied. The default still hands the agent everything. No adoption figure is published. None of it reaches the cloud sessions where nobody is watching.
How we Assure
Every tool call travels and the prompts stay behind
The same app can now export Copilot agent activity as OpenTelemetry, set up once by an administrator rather than by each developer. What travels is the session’s shape. That means the requests made to models, the tools the agent called, and step-by-step traces of what it ran. Prompt and response content is excluded by default. GitHub tells administrators to check their content-capture settings before enabling it.
Our own ask of a client is harder than it sounds. Months later they should be able to rebuild the whole of what one of their agents got up to.
What an agent did can be reconstructed afterwards, and every incident an agent is named in records the systems it touched and how it was resolved.
Picture two firms exporting these traces. One has content capture on and can say why an agent deleted a branch. The other can say only that the branch went. Read as a checkbox, the sentence above passes on both of them. Nothing settles what firms will switch on, and a reasonable reader could hold that tool calls rebuild an action well enough, with the words belonging to a separate question about what may lawfully be kept. If you think the trace is enough on its own, tell us why: transform@dromologue.ai.