GitHub Adds Reviewable AI Agent Controls to Issues
New approvals, confidence ratings and rationales give repository teams a clearer way to supervise automated issue changes without mistaking review for security.
GitHub has added a supervision layer for AI agents working inside Issues, bringing approvals, confidence ratings and recorded rationales into public preview. The change matters because agent automation is moving beyond drafting text: it can label, assign, type and close work items that shape what a software team sees and does next.
The new controls let teams decide whether an automation should apply a change immediately or present it as a suggestion. Suggested changes wait in a panel on the issue, where a reviewer can accept or decline them individually or in a group.
What the controls do
Agents can attach a high, medium or low confidence rating to supported actions. High-confidence changes may be applied automatically, while medium- and low-confidence actions can be held for review. Repository administrators can also configure the confidence threshold that determines when a human stays in the loop.
Every supported action records a rationale, whether the change is automatic or proposed. That creates a visible audit trail showing what changed and why. At launch, the system covers labels, fields, issue type, closure and assignees. It works with GitHub Agentic Workflows and Copilot cloud agent automations, and the same capabilities are exposed through REST and GraphQL APIs.
Practical uses include triaging incoming issues, filling missing metadata and flagging suspected spam. Search support for issues with pending suggestions gives maintainers a queue of uncertain actions rather than forcing them to inspect every automated decision.
The security line GitHub draws
GitHub is unusually direct about the limitation: approvals are a workflow convenience, not a security control. An agent that already has permission to change an issue can apply a change directly if its instructions allow that path. The review panel does not create a server-side authorization boundary.
That distinction is essential for teams designing agent policies. Confidence scores can prioritize attention, but they are produced by the automation and are not proof that a change is safe. Rationales make decisions easier to inspect, but they do not replace least-privilege permissions, repository rules or human accountability for consequential actions.
Why it matters
The difficult part of enterprise agent adoption is not only granting an agent the ability to act. It is making those actions legible enough for people to supervise without turning every automation into another inbox.
GitHub’s approach separates three questions that are often blurred together: what the agent wants to do, how certain it says it is and whether a person must approve the result. That is a useful control model—even if the platform is careful not to call it a security boundary.
Status
Confirmed. GitHub documents the feature as available in public preview. Availability, supported actions and limitations are first-party product information.
Sources
Update note: Last reviewed 2026-07-24. We will revise this post if GitHub changes the preview scope or security model.
Sources
Drafted with AI assistance from source briefs; reviewed for citation completeness and label accuracy.