policy-and-managed-settings

Routes enterprise Copilot controls to runtime managed settings, VS Code policies, or extension policies.

Updated Sep 3, 2026
One-click install
npx skills add https://github.com/az0512124155azz-sys/CodeForge --skill policy-and-managed-settings-az0512124155azz-sys
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: policy-and-managed-settings
Source: https://github.com/az0512124155azz-sys/CodeForge/tree/main/.github/skills/policy-and-managed-settings
Command: npx skills add https://github.com/az0512124155azz-sys/CodeForge --skill policy-and-managed-settings-az0512124155azz-sys

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Adding an enterprise control for Copilot, agents, or VS Code requires choosing the correct policy destination—runtime managed settings, VS Code configuration policy, extension policy, or a split implementation—and following the right declaration, export, and testing procedure. Choosing the wrong channel leads to duplicated enforcement, silently ignored settings, or deprecated integration paths. ## Core Features & Use Cases - Policy destination routing: A decision flowchart routes any new Copilot/agent/LLM control to the SDK/runtime managed-settings contract, a VS Code configuration policy, an extension-provided setting policy, or a split runtime/editor control based on where the governed behavior is implemented. - Managed-settings implementation guidance: Detailed references cover declaring managedSettings keys on policies, structured (object/array) settings carried as JSON strings, per-key channel precedence (native MDM > server > file), and the policyReference mechanism for one policy governing many settings. - Export and testing procedures: Step-by-step instructions for running npm run export-policy-data, verifying policyData.jsonc, and testing locally with the mock policy server. - Use Case: When adding a new enterprise control that disables a Copilot agent tool, use this Skill to determine it belongs in the runtime managed-settings schema, then follow the SDK/runtime guide to declare the key, wire enforcement, and add tests. ## Quick Start Ask the Skill where a new enterprise control for a Copilot agent feature should be implemented and follow the routed guide to declare and export the policy.

Frequently Asked Questions about policy-and-managed-settings

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add a new enterprise policy for a Copilot feature in VS Code?▼

First decide where the governed behavior is implemented. Runtime behavior (tools, MCP, sandbox, agent loop) belongs in the SDK/runtime managed-settings contract; editor or workbench behavior gets a VS Code configuration policy with a `policy:` block; extension settings use `extensionConfigurationPolicy` in vscode-distro.

How do I declare a managed-settings key on a VS Code policy?▼

Add the dot-path key as a constant in copilotManagedSettings.ts, then add `managedSettings: { [KEY]: { type } }` and a `value` callback to the policy. For pass-through locking use the `managedSettingValue(KEY)` helper, and run `npm run export-policy-data` to update the catalog.

What is the precedence between native MDM, server, and file-based managed settings?▼

Native MDM wins over the server-delivered channel, which wins over the file-based channel, resolved per key. A key unset in higher-precedence channels is still filled by lower ones, and the merged bag is projected onto declared policy keys.

Why is my structured managed setting silently ignored in VS Code?▼

Structured object or array values travel as JSON strings, so the managed key must be declared with `type: 'string'`. Declaring 'object' or 'array' is a compile error, while 'number' or 'boolean' compiles but fails the runtime typeof check and the key is dropped.

Can I add a new setting through the legacy VS Code settings bridge?▼

No. The legacy-setting bridge and pre-1.133 permission-policy translation are bounded compatibility paths for existing settings only. New runtime-owned controls must be defined directly in the managed-settings schema and SDK contract.

How do I test Copilot managed settings locally?▼

Run `npm run mock-policy-server` to serve mocked managed-settings responses, then apply them via the Developer: Sync Account Policy command. It also supports file-based deployment, precedence testing, and forceRemoteSettingsRefresh failure scenarios.