GitHub now lets organizations manage Copilot code review through REST and GraphQL APIs from enterprise policy down to individual repositories. This turns a manual setting into an automatable, auditable platform control.
What changed
As of November 6, 2026, administrators can read and update code review policies through APIs. Responses can identify Copilot reviews and comments, report review effort, and expose declared sources such as skills, MCP servers, and custom instructions. On November 5, the usage metrics API also added code review detail and addressed-finding rates.
Governance hierarchy
- Enterprise: enable, disable, or delegate the decision to organizations.
- Organization: control enablement, default effort, and runner settings within enterprise policy.
- Repository: control effort, custom instructions, and MCP tool usage.
Critical authentication constraint
Enterprise and organization settings endpoints do not support GitHub Apps or fine-grained personal access tokens. Repository endpoints support both with Administration read/write permissions. Top-level automation therefore needs a deliberate credential design that avoids distributing highly privileged classic PATs.
Why it matters
Policy as code enables baselines, drift detection, and cost controls. Explicit attribution separates human and Copilot reviews, while metrics can measure addressed findings, severity, and later human change requests before the service is expanded.
Adoption checklist
- Define enterprise policy and the decisions organizations may inherit or override.
- Pilot in low-risk repositories with documented bypass lists.
- Use least privilege and separate enterprise automation from repository automation.
- Track AI credit use, addressed-finding rate, false positives, and review latency.
- Treat custom instructions and MCP servers as governed security dependencies.
Availability and licensing
These capabilities are available on Copilot Pro, Pro+, Max, Business, and Enterprise plans. GitHub published them as an available improvement, not a preview. For the broader Agentic DevOps context, read our AZ-401 certification guide.