Configure observability and control for autonomous agents

Unlock the complete study guide.

Bundled into the existing Developing in Agentic AI Systems premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

Where control and evidence live for an autonomous agent
Control which tools Copilot CLI sees and may run
Bound how long autopilot keeps going
Oversee an agent while it is still running
Hooks that decide on individual tool calls
Hooks that observe rather than approve
Keep cloud agent hook records outside the sandbox
Keep workflow secrets out of cloud agent sessions
Repository acceptance still governs agent pull requests
Approve workflow runs on agent pull requests
Put the approval on the job that acts: environments
Package evidence a reviewer can trust
Evidence a run leaves beyond its artifacts
Exam reasoning: match the requirement to the control

Requirement to control: what meets it, and the tempting control that does not

Requirement	Control that meets it	Tempting control that does not
Routine test commands run without prompts, URL checks stay	A scoped --allow-tool pattern	--allow-all or --yolo, which also enables all paths and URLs
Local Git work runs; git push is always refused	Allow the Git pattern and --deny-tool for git push	Leaving push unapproved, which still offers a prompt
The model must not see a tool at all	--available-tools or --excluded-tools	--deny-tool, which governs permission rather than visibility
Refuse one dangerous command based on its arguments	A preToolUse hook returning permissionDecision: deny	postToolUse, which runs after the call has succeeded
Block the call when the policy check crashes or exits nonzero	A command hook, whose crash or nonzero exit denies (a timeout still falls through)	An HTTP hook, whose errors and timeouts fall through
A person must decide before a risky cloud agent change takes effect	Refuse it in the run, and put the person at a later checkpoint: required review or a protected environment	A preToolUse ask, which cloud agent treats as deny
Keep hook audit records from a cloud agent session	An HTTP hook to a firewall-permitted destination	Files written inside the ephemeral sandbox
Changes to agent configuration need a named team's approval	CODEOWNERS plus Require review from Code Owners	An instruction in .github/copilot-instructions.md
Someone other than the initiator approves the deploy job	An environment with required reviewers and Prevent self-review	A wait timer, or simply listing more reviewers
Reviewers and later jobs inspect the plan and traces	actions/upload-artifact, with needs on the consuming job	A dependency cache or the job's local filesystem
Keep a portable record of a programmatic CLI session	--share=PATH, or /share file interactively	Raising --log-level without setting --log-dir

Decision tree

Cheat sheet

Preapprove specific routine tools to reduce interruptions without granting every capability.
Use --deny-tool for operations that must be rejected rather than offered for approval.
Tool visibility and permission to run a tool are different CLI controls.
The CLI's allow-all shortcut expands more than shell-command approval.
Reset session approvals when previously trusted work should require renewed permission.
Autopilot changes task continuation rather than merely producing a plan.
Set an explicit continuation cap when autonomous work must have a bounded continuation budget.
An administrator policy can prevent users from enabling --allow-all.
Queue follow-up guidance when it should run after the current CLI task finishes.
Inspect tool arguments in preToolUse to deny dangerous calls before they execute.
A cloud-agent preToolUse ask decision is treated as a denial.
Any preToolUse denial blocks the call when several hooks run.
A failed command hook and a timed-out command hook have different enforcement behavior.
Do not assume an unavailable HTTP policy hook will deny a tool call.
Machine-wide CLI policy hooks are not disabled by ordinary disableAllHooks settings.
Use postToolUse for inspection or processing after a successful tool call.
Use errorOccurred for error-specific notification rather than general session completion.
Export cloud-agent hook output that must survive the sandbox.
Use preToolUse rather than permissionRequest for cloud-agent policy decisions.
Protect sensitive configuration with CODEOWNERS and required code-owner review together.
Repository rulesets and required checks still govern agent contributions.
Workflow execution approval is a separate checkpoint from accepting an agent pull request.
The person who requested a cloud-agent pull request cannot provide its approval.
Separate agent-accessible secrets from secrets reserved for Actions workflows.
Use workflow artifacts for files that reviewers and later jobs must inspect.
Order dependent jobs explicitly before they consume an agent's artifacts.
Select the files included in an artifact instead of uploading an undifferentiated workspace.
Per-artifact retention must fit the repository, organization, or enterprise limit.
Use an artifact name to retrieve a particular review package.
Identify and authorize retrieval when review evidence comes from another workflow run.
Publish revised evidence as a distinct artifact when using immutable v4 artifacts.
Artifact digest validation reports a mismatch as a warning rather than proving review success.
A Verified agent commit is a provenance signal, not an acceptance result.
Export a CLI session to a file when reviewers need a portable session record.
Configure CLI log destination and verbosity with separate options.
Treat full-content telemetry capture as an explicit sensitive-data decision.
Use structured task metadata to build an agent-status inspection view.
Attach a protected environment to the workflow job whose execution needs approval.
An environment's required-reviewer list permits approval by one listed reviewer.
Enable Prevent self-review when the workflow initiator must not approve the run.
Disable administrator bypass when environment protections must apply without that exception.
A wait timer supplies a delay, not a human approval decision.
Configure deployment branch and tag patterns for the intended ref type.
A workflow reference to a new environment does not copy an existing approval policy.
Deleting an environment fails jobs waiting on its protection rules.
Environment-bound workflow jobs expose deployment objects and status transitions.
Make plan checks required without mistaking artifact presence for plan approval.
Identify both the producing workflow run and the code state for review evidence.
Control runtime capabilities separately from repository acceptance.
Steer an active cloud-agent session without stopping the run.

Unlock with Premium — includes all practice exams and the complete study guide.