GitHub ships approval workflows and confidence ratings for AI agents managing Issues

GitHub Ships Confidence Ratings and Approval Gates for AI Agents in Issues

AI agents are already labeling, typing, and closing issues on repositories across GitHub. As of July 23, GitHub wants the people who run those repositories to decide how much of that work should happen without a human checking it.

Three new governance controls are now in public preview. Agents rate each supported action they take as high, medium, or low confidence. High-confidence changes apply automatically. Medium and low changes wait in a review panel on the issue, where a maintainer can accept or decline them individually or all at once 1.

Each supported action records its rationale, whether it takes effect on its own or sits waiting for approval. That gives repository maintainers an audit trail showing what changed and the reasoning behind it, visible on each suggestion before a decision is made 1.

Repository admins configure the confidence threshold that determines which changes apply on their own and which get held back. The calibration belongs to each team. A small group triaging bugs might let an agent label and prioritize with minimal friction. A high-traffic public repository can require a human stamp on every change 1.

GitHub draws one boundary plainly. The announcement states that "approvals are a workflow convenience, not a security control" 1. The controls do not enforce a server-side restriction. An agent that already has permission to modify issues can apply changes directly, bypassing the suggest-and-review pipeline entirely 1.

That disclosure matters more than the features themselves. These controls route agent output through a human-readable review layer. They do not restrict what an agent with write access can actually do. The distinction is between visibility and enforcement, and GitHub tells its users exactly where the line sits.

The capabilities work with GitHub Agentic Workflows and Copilot cloud agent automations, and are also available through the REST and GraphQL APIs 1. At launch they cover labels, issue fields, issue type, closures, and assignees 1.

GitHub names triage, metadata enrichment, and spam detection as practical starting points. For triage, the reasoning attaches to each action rather than appearing as a separate comment on the issue, and maintainers can review selected changes before they apply. For spam detection, the system flags suspected spam with an explanation and holds borderline cases for a person to decide 1.

Teams already running GitHub Agentic Workflows need to upgrade their workflows to add issue intent support. After upgrading, supported safe outputs include intent information automatically while remaining backward compatible. Workflows can require intents for specific outputs by setting a configuration flag, or explicitly opt out 1. Copilot cloud agent users need no update; the controls appear when creating an automation from the repository's Agents tab 1.

Issues with pending agent changes are findable through search using the has:suggestions filter, so maintainers do not have to scan every issue to find what needs their attention 1.

The ideas driving these controls are not new. Confidence scoring, human-in-the-loop review gates, and action audit trails have circulated in AI safety research and regulatory debates for years. What shifted this week is the delivery format. Those concepts arrived as configuration options in a shipping product, not as recommendations in a policy document.

GitHub's approach lets each repository draw its own line between agent autonomy and human accountability, attach reasoning to each supported change, and tell users with notable directness where that line ends. The directness is the signal. A platform that ships governance controls and immediately labels them a convenience rather than a guardrail is setting expectations with precision. The controls make agent behavior visible and reviewable. They do not make it safe. Whether that distinction holds up as agents take on higher-stakes decisions is the question this public preview does not answer.