policy-and-managed-settings

Route enterprise Copilot controls to runtime managed settings, VS Code policies, or extension policies.

Updated Aug 20, 2026
One-click install
npx skills add https://github.com/basedgod55hjl/vsbrax --skill policy-and-managed-settings-basedgod55hjl
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: policy-and-managed-settings
Source: https://github.com/basedgod55hjl/vsbrax/tree/main/.github/skills/policy-and-managed-settings
Command: npx skills add https://github.com/basedgod55hjl/vsbrax --skill policy-and-managed-settings-basedgod55hjl

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? When adding or modifying any Copilot, agent, LLM, permission, sandbox, MCP, telemetry, or configuration control in VS Code, contributors must decide where the enterprise policy belongs—runtime managed settings, VS Code configuration policy, extension policy, or a split implementation—and follow the correct declaration, export, and testing procedure. ## Core Features & Use Cases - Policy Routing Decision Tree: A flowchart routes each control to the correct destination based on where the governed behavior is implemented, with dedicated guides for SDK/runtime, VS Code, extension, split, and legacy migration paths. - Managed Settings Reference: Documents the canonical dot-path bag, three delivery channels (native MDM, server, file-based) with per-key precedence, structured JSON-string encoding, and the managedSettingValue helper pattern. - Export and Testing Workflow: Prescribes npm run export-policy-data, the policyData.jsonc verification step, and local testing via the mock policy server. - Use Case: When adding a new enterprise control that disables a Copilot agent tool, use this Skill to determine it belongs in the runtime managed-settings schema, declare the key constant, attach it to a policy, and export the policy catalog correctly. ## Quick Start Ask the assistant to use the policy-and-managed-settings skill to decide where a new Copilot enterprise control should be implemented and walk through the required declaration and export steps.

Frequently Asked Questions about policy-and-managed-settings

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add a new enterprise policy for a Copilot feature in VS Code?▼

First decide where the governed behavior is implemented. Runtime-owned behavior (tools, permissions, sandbox, MCP) goes in the managed-settings SDK contract; editor/workbench behavior gets a VS Code configuration policy with a policy block, then run npm run export-policy-data.

What is the difference between VS Code configuration policy and managed settings?▼

VS Code configuration policy governs editor and workbench behavior via OS policy or account data. Managed settings are the canonical channel for Copilot enterprise controls, delivered through native MDM, the GitHub server, or a file, with per-key precedence.

How do managed settings precedence rules work across delivery channels?▼

Precedence is resolved per key: native MDM wins over the server-delivered channel, which wins over the file-based channel. A key unset in higher channels is still filled by lower ones, and the merged bag is projected onto declared policy definitions.

Can I add a new GitHub token entitlement field for a Copilot policy?▼

No. GitHub token and account policy data fields are deprecated for new controls. New Copilot enterprise controls must use managed settings with runtime/SDK enforcement instead of adding properties to IPolicyData.

Why is my managed setting silently ignored at runtime?▼

The projection drops keys whose runtime value type does not match the declared type. Structured object or array settings must be declared as type string carrying JSON; declaring number or boolean compiles but fails the typeof check and the key is dropped.

How do I test Copilot policy changes locally?▼

Use the mock policy server started with npm run mock-policy-server to serve managed_settings responses, then apply them in the client with the Developer: Sync Account Policy command. Presets and a JSON control API allow deterministic endpoint mocking.