Three principles

Part 7 of 16

How to control it

Keep approvals on, and enforce them: most incidents start where an approval was removed, so turn off global auto-approve and allow-all flags, and let policy keep them off.
Treat what Copilot loads as code: .vscode/, .github/, MCP entries, instruction files, hooks and .git/config all run or instruct, so review them like a pull request before trusting a folder.
Contain the commands you approve: the terminal sandboxes limit what an approved command can read and reach, so turn them on with network off.

/* Without JS the drawer cannot open, so show the sidebar inline instead. */ @media (max-width: 900px) { .sidebar { position: static; transform: none; width: auto; box-shadow: none; } .navbar-toggle, .sidebar-head { display: none; } }

Security for Copilot Development: Three principles

How to control it

Three principles