GitHub's latest Copilot update for JetBrains introduces a preview feature called assisted approvals, which automatically approves low-risk AI-generated code changes while still prompting developers for higher-risk actions. The feature represents a shift in how developers interact with AI agents, moving from manual approval lists to letting the AI itself decide what's safe enough to proceed without human sign-off.

What Changed in Copilot 1.18?

Version 1.18.0 of GitHub Copilot for JetBrains, released on September 18, 2026, introduces assisted approvals as a preview feature available only for Copilot agent sessions. Previously, developers had limited options: either approve all tool calls automatically through an "Allow All" switch, or manually configure auto-approve rules for specific commands and file operations. The new assisted approvals feature sits between these extremes by letting Copilot's own risk classifier determine which actions are safe enough to proceed without interrupting the developer.

The goal is straightforward: reduce interruptions for routine, low-risk operations while keeping developers in control of potentially dangerous actions like file deletions or terminal commands. However, GitHub has not publicly disclosed exactly how the classifier defines "low-risk," which specific tools qualify, or how the new feature interacts with existing rule-based auto-approve settings.

How Is GitHub Copilot Being Used in Real-World Development?

Beyond the JetBrains update, GitHub Copilot is being deployed as a full orchestration layer for end-to-end agentic DevOps workflows. Tieto Tech Consulting's Network Products team, which maintains mission-critical telecom software deployed in 20 countries, successfully adopted GitHub Copilot to double feature implementation productivity while maintaining telecom-grade quality standards.

The team's approach demonstrates how Copilot can coordinate specialized AI agents across the entire software lifecycle, not just code generation. Rather than replacing existing on-premises tools like GitLab, Jira, and Jenkins, the team used GitHub Copilot as a developer-facing control plane that orchestrates work across these established systems through custom Model Context Protocol (MCP) integrations.

"This is the distinction between AI-assisted coding and agentic DevOps. The former helps with a coding task while the latter coordinates a governed flow of work across the software lifecycle," the team noted.

Tieto Tech Consulting, Network Products Team

How to Implement Agentic DevOps with GitHub Copilot

• Create Specialized Agents: Configure separate AI agents for distinct responsibilities such as requirement analysis, story breakdown, technical planning, implementation, documentation, review, and maintenance. Each agent receives only the instructions, context, and tools required for its specific role.
• Encode Product Context: Store repository-specific instructions, architectural constraints, coding standards, and testing rules in version-controlled files. Default agent mode proved insufficient for complex codebases; custom agents and repository-specific instructions were essential for producing relevant and reliable results.
• Integrate with Existing Tools: Use Model Context Protocol (MCP) to connect GitHub Copilot with on-premises systems like GitLab, Jira, and Jenkins. This hybrid architecture allows organizations to introduce AI capabilities without abandoning established platforms or compromising regulatory and security requirements.
• Implement Human Review Gates: Maintain approval loops at critical stages. For example, product owners review epic analysis and story breakdowns before work enters development, and engineers review technical plans before agents receive write access to code.
• Validate Through Existing Pipelines: Route all AI-generated code through the same CI/CD validation mechanisms used for developer-written code, including build, unit-test, and integration-test gates.

The Tieto team's experience showed measurable results: faster feature implementation when using the agent-based process end-to-end, substantial time savings in unit-test and documentation generation, better-structured user stories with improved traceability, and broader test coverage through AI-generated edge cases and variants. Knowledge that previously lived in individual developers' heads was encoded in instructions, skills, templates, and agent definitions stored under version control, improving overall team productivity.

What Risks Come with Assisted Approvals?

The assisted approvals feature carries real security considerations that developers should understand before enabling it. GitHub's documentation warns that the previous "Allow All" switch can lead to data loss or security issues by letting agents act without approval. The April 2026 update added Global Auto Approve, which automatically approves all tool calls across all workspaces, including potentially destructive actions such as file edits, terminal commands, and external tool calls.

Assisted approvals introduces a new variable: the risk classifier itself. Since GitHub has not disclosed how the classifier defines "low-risk" or which tools it considers safe, developers should treat the preview label as a genuine warning. The recommendation is to test the feature on a sandbox project before trusting it with production repositories.

Enterprise administrators may have additional control options. GitHub's August 2026 update on enterprise managed settings indicates that administrators can set permissions to disable Bypass Approvals or Autopilot in the Copilot agent for JetBrains. However, GitHub has not confirmed whether this policy also governs the new assisted approvals feature, so administrators relying on these controls should test before assuming coverage.

What Does This Mean for Teams Adopting AI Agents?

The combination of assisted approvals and agentic DevOps workflows signals a broader shift in how AI tools integrate into software development. Rather than AI assisting individual developers with isolated coding tasks, the industry is moving toward AI orchestrating entire workflows across teams, tools, and quality gates. The Tieto case study demonstrates that this approach works in demanding real-world environments with strict quality requirements, mature codebases, and distributed teams.

For organizations considering similar implementations, the key takeaway is that agentic AI does not require abandoning existing infrastructure. By using controlled interfaces like MCP and maintaining human approval gates at critical stages, teams can introduce AI capabilities while preserving security, traceability, and regulatory compliance. The assisted approvals feature in Copilot 1.18 represents one step in this direction, though its preview status suggests developers should approach it cautiously until GitHub provides more transparency about how the risk classifier works.