On September 1, 2026, GitHub released a public preview allowing GitHub Copilot code review to officially approve pull requests. For the first time, an automated AI agent can satisfy a repository’s required-approval branch protection rule, shifting Copilot from an advisory feedback tool into an authoritative merge gatekeeper.

The feature is available across GitHub Copilot Pro, Pro+, Max, Business, and Enterprise plans, but remains strictly disabled by default at all organization and repository levels.

Confirmed

  • Approval assessment: Every Copilot code review now appends an “approval assessment” within the overview comment, detailing whether the model considers the changeset safe to merge. By itself, this assessment is advisory and does not count toward merge rules.
  • Authorized sign-off: When an administrator explicitly enables approvals, Copilot can submit an official APPROVED review that satisfies the repository’s required peer-review rules.
  • Three-tier governance: Controls are split across Enterprise (org-level delegation or enterprise-wide lock), Organization (repo-specific or org-wide enablement), and Repository levels.
  • Path-based scoping: Repository maintainers can limit Copilot’s approval authority to specific file paths (such as documentation, CSS, test suites, or localized configs), preventing the model from greenlighting changes to security-sensitive directories or core application logic.
  • Stale approval dismissal: Pushing new commits automatically dismisses Copilot’s approval, exactly matching the lifecycle of a human reviewer’s sign-off. Maintainers must explicitly request a fresh review from Copilot to re-approve.

Unknown

  • Compliance and audit acceptance: Whether enterprise compliance frameworks (SOC 2, ISO 27001, FedRAMP) that mandate human peer reviews will accept AI-signed branch approvals without secondary human countersignatures.
  • Failure modes on subtle regressions: How reliably Copilot catches edge-case concurrency bugs or architectural anti-patterns versus stylistic or syntactic checks during approval decisions.
  • Downstream agent loops: Whether autonomous coding agents (such as Codex CLI, Claude Code, or Cursor) paired with Copilot approvals could establish unsupervised PR-creation-to-merge loops in permissive repositories.

Why it matters

Until now, AI code assistants operated on the developer side of the pull request: drafting code, suggesting diffs, or commenting on syntax. Giving an AI model the authority to satisfy merge requirements crosses an institutional boundary. While path-scoping allows teams to automate low-risk documentation and dependency churn, it also introduces the risk of rubber-stamp approvals if teams enable broad repo permissions to bypass human review bottlenecks.

Our take

GitHub’s safety guardrails here are deliberate: keeping approvals off by default, auto-dismissing on new commits, and offering path-based filtering reflect a measured approach to developer blast radius. The structural risk lies in blanket repository authorization, which risks turning automated sign-offs into a rubber-stamp loop. The rational equilibrium for engineering teams is scoped automation: Copilot can handle low-friction sign-offs on documentation, test fixtures, and cosmetic styling, while mandatory human peer review remains strictly enforced for core business logic, cryptography, and schema migrations.

Sources