An IDE agent has employee permissions: what to do

Over three weeks, GitHub released four updates that, individually, look like changelog entries: managed default models in Copilot for JetBrains, a local sandbox for agents, automated SSO authorization for PATs and SSH keys, and the latest CodeQL.

Together, they present engineering leaders with a new task: managing an agent like an employee with access rights. In Copilot for JetBrains, an enterprise administrator uses managed settings to choose the agent model that starts every new conversation.

A developer can switch models manually in the picker, but the administrator sets the starting point. In the weekly release of September 21 Copilot now includes Claude Opus 5.5, GPT-6 Sol, GPT-6 Luna, and Grok 4.7.

Access depends on the plan: Opus 5.5 and GPT-6 Sol are available with Pro+, while Luna and Grok 4.7 are available with Pro.

The same release introduced a local sandbox in the Copilot app.

It limits the agent’s access to files, the network, and credentials.

The third update concerns SSO authentication: an Enterprise Cloud administrator can enable delegation through GitHub Apps installed at the enterprise level.

Then standard PATs and SSH keys are authorized in SSO organizations automatically, so developers do not need to do it manually in each organization.

When a company has a dozen models, every developer chooses their own.

One chooses the most expensive, another the fastest, and a third the one they read about yesterday.

Request cost, code quality, and the risk of context leakage vary from person to person, so the engineering director cannot forecast the budget. Access works the same way. The SSO changelog says it directly: manual authorization for each organization creates friction, so people create long-lived tokens to avoid reissuing them.

An inconvenient process creates unsafe behavior.

Now add an agent that reads files, accesses the network, and uses the same tokens. A long-lived PAT on a developer’s machine gains a second user: it works faster than a person and does not ask where it is allowed to go.