Domain 6 of 6 · Chapter 2 of 2

Validate and Operate AI Tools

Unlock the complete study guide.

Bundled into the existing GitHub Copilot premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Why every Copilot output is a proposal
  • Scoping the request: context, prompts and coding scope
  • Scoping an agent task with acceptance criteria
  • Approving agent commands
  • Stopping an agent request is not undoing it
  • A check vouches only for the question it asks
  • Validating functional correctness
  • Validating fit: architecture and standards
  • Scrutinizing suggested dependencies
  • Independent tools: evidence from outside Copilot
  • Validating security: code that compiles is not proven secure
  • Reviewing a Copilot cloud agent pull request
  • Validating generated text
  • Copilot code review: a second reviewer, not the last
  • Public code matches: treat output as third-party code
  • Human oversight: expertise, overreliance, decisions
  • Obligations: laws, regulations and terms
  • Staying current as Copilot changes
  • Practice scenarios: the check that proves too much

A check vouches only for the question it asks: what each piece of evidence shows, and what still has to happen

Evidence you haveWhat it showsWhat it does not showWhat still has to happen
Successful compileThe code is syntactically validThat it meets the requirement or is secureReview against intent, test edge cases, security review
Green functional testsThe tested inputs behave as expectedUntested boundaries, error paths or vulnerabilitiesAdd boundary, error and security tests
Clean linter runNo violations of the enabled rules were reportedVulnerabilities, secrets or vulnerable dependencies, which the security scanners targetAdd code scanning, secret scanning and dependency analysis; a linter is not a substitute for them
Clean security scannersNo detected known vulnerability classes, introduced secrets or known vulnerabilities in referenced dependenciesThat the design is secure or the change is correctSecure design review and testing by a person
Copilot code review with no commentsCopilot did not flag anythingThat the pull request has no defectsCareful human code review
Verified agent commitCopilot cloud agent made the commit, unalteredThat the implementation was validatedReview and test before merging
Copilot's explanation of the codeOne reading of what the code doesHidden behavior it left out or got wrongCheck against the code, current docs and observed behavior

Decision tree

Waiting for your approvalto run a command?Approve only after readingthe exact action and targetYesNoA code review comment?from Copilot code reviewEvaluate each commentit may be a false positiveYesNoExplanation, pull requestsummary or commit message?Check against code and diffbefore relying or publishingYesNo, it is codeSecurity-sensitive orcritical code?Validate intent, edge cases, fitplus deeper security review, scannersYesNoValidate intent, edge cases, fitplus security review and scannersAlways: an accountable person owns the result
Cheat sheet

Cheat sheet

  • Developers must understand generated code before using it
  • Generated output must be checked against developer intent
  • Validation must exercise boundaries and error paths
  • Generated code must fit the codebase's architecture and standards
  • Independent tools strengthen output validation
  • Compiling generated code is not evidence of security
  • Generated code must be checked for common security antipatterns
  • Security-sensitive and critical code needs deeper validation
  • Security scanners add a distinct validation layer
  • Automated agent scanning does not guarantee safe output
  • Generated explanations can be inaccurate or incomplete
  • Generated pull request summaries require author review
  • Generated commit messages must reflect the final selected changes
  • AI code review can miss real defects
  • AI code review comments can be false positives
  • Relevant context improves Copilot responses
  • Irrelevant context can dilute output quality
  • Clear, scoped prompts improve control of generated output
  • Copilot performs best within its intended coding scope
  • Agent commands must be reviewed before approval
  • Agent tasks need explicit scope and acceptance criteria
  • Agent-generated changes require review before merge
  • Agent traceability supports accountable review
  • Stopping an agent request cannot roll back completed actions
  • A bang-prefixed chat command bypasses the agent approval flow
  • Generated code can match publicly available code
  • Potentially unoriginal code needs IP and security review
  • AI use must satisfy applicable laws, policies, and terms
  • Copilot augments rather than replaces human expertise
  • Overreliance amplifies hard-to-detect AI errors
  • Human review must precede consequential use of AI output
  • Responsible use requires current risk and product knowledge

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. https://github.blog/changelog/2026-04-01-research-plan-and-code-with-copilot-cloud-agent/
  2. https://docs.github.com/en/copilot/responsible-use/copilot-code-completion
  3. https://docs.github.com/en/copilot/responsible-use/agents
  4. https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/gh-300
  5. https://docs.github.com/en/copilot/get-started/best-practices
  6. https://docs.github.com/en/copilot/concepts/prompt-engineering-for-copilot-chat
  7. https://docs.github.com/en/codespaces/about-codespaces/what-are-codespaces
  8. https://docs.github.com/en/copilot/responsible-use/chat
  9. https://docs.github.com/en/copilot/tutorials/cloud-agent/get-the-best-results
  10. https://docs.github.com/en/copilot/how-tos/copilot-cli/use-copilot-cli/allowing-tools
  11. https://code.visualstudio.com/docs/agents/run/agent-harnesses
  12. https://code.visualstudio.com/docs/agents/run/review-code-edits
  13. https://docs.github.com/en/copilot/tutorials/review-ai-generated-code
  14. https://docs.github.com/en/actions/get-started/continuous-integration
  15. https://docs.github.com/en/copilot/responsible-use/pull-request-summaries
  16. https://docs.github.com/en/copilot/responsible-use/copilot-commit-message-generation
  17. https://docs.github.com/en/copilot/concepts/code-review
  18. https://docs.github.com/en/site-policy/github-terms
  19. https://github.blog/changelog/label/copilot/