Hey everyone. Imagine: a pull request lands mid-afternoon. The diff looks tidy. CI is green. Copilot’s review summary says the change looks ready. Then someone on the platform team asks a quieter question: should that same assistant be allowed to count as a required approval?
That question stopped being theoretical on September 1, 2026. GitHub shipped a public preview where Copilot code review can submit a real approval, the kind that can satisfy a repository’s required-approvals rule when admins turn that on. An approval assessment in the overview comment is not the same thing as merge authority. One is a recommendation. The other can move the merge button.
Hi, I’m Robert Massey, software engineer and computer science professor with 25 plus years in the trenches. Today’s post is about governance and ownership, not model worship. AI is a tool and an assistant. Programming is still a skill. Software engineering is still engineering solutions with software. When a tool can sign the review form, the engineer still owns what ships.
Assessment is not approval
GitHub’s changelog draws a line teams should appreciate.
Every Copilot code review can include an approval assessment: Copilot’s read on whether the PR looks ready. That assessment alone does not count toward merge requirements. It is advice sitting next to the comments.
Separately, admins can authorize Copilot to submit an approval that counts like a teammate’s sign-off. That capability is off by default. It is configurable at the enterprise, organization, and repository levels. At the repository layer, admins can also limit which file paths Copilot is allowed to approve.
If new commits land after Copilot approves, GitHub says the approval is dismissed the way a human reviewer’s would be, and you can request a fresh review.
Read that twice before anyone flips a switch in a production monorepo. Preview features move. Policies drift. The merge seat is still a design decision.
Why this lands harder in an agent week
A few days later, on September 4, GitHub also made GPT-6 Astra generally available in Copilot for eligible plans. GitHub describes Astra as geared toward longer-horizon, autonomous coding and agentic work: plan, diagnose, verify, and confirm before calling a task done. Rollout is gradual. Business and Enterprise admins still control model access through Copilot model policy. Usage is billed under provider list pricing on Copilot’s usage-based path.
Think of it like load balancing review capacity. You can put more traffic on an automated lane. You still decide which routes are allowed to touch payments, auth, migrations, and production config. A junior hire who writes clean code does not automatically get unrestricted merge rights on day one. The same instinct applies when the “junior” never sleeps and never gets embarrassed.
The failure mode to name out loud
Here is the scenario that should make any staff engineer sit up: an agent opens the pull request, Copilot reviews it, and Copilot’s approval is allowed to satisfy the required-approvals rule. Same vendor family on both sides of the gate. Even if the implementation is careful, the accountability story gets fuzzy.
Code review was never only about catching typos. It is a social and technical checkpoint for intent, blast radius, architecture drift, and “who gets paged when this breaks.” Automating the low-level scan is useful. Handing away the human gate on high-risk paths is a policy choice, not a productivity free lunch.
Secondary write-ups already stress path scoping, stale-approval dismissal, and keeping merge requirements honest. Treat those as implementation checklists against GitHub’s docs, not gospel. Prefer the official changelog and your own repo ruleset before you brief leadership.
A practical playbook before you enable it
If you are evaluating the preview, start boring and measurable.
1. Keep assessment on; keep countable approval off until you mean it.
Let the team learn what Copilot’s “ready” signal looks like on your codebase without letting it satisfy required reviews yet.
2. Canary on cheap paths.
Docs, non-sensitive fixtures, generated changelog text. Require that every changed file match an allowlist if you use path controls. A PR that also touches auth or billing should fall out of the automated approval lane.
3. Never let AI approval be the only approval on risky surfaces.
Auth, money movement, data deletion, infrastructure, secrets, and anything with compliance weight still need a named human owner. Required checks, CODEOWNERS, and “dismiss stale reviews” are your friends.
4. Measure merges without a human eye.
If you turn countable Copilot approvals on anywhere, track how often a merge clears the approval bar with no person in the reviewers list. That metric is more honest than vibes from a demo PR.
5. Review agent PRs like a skeptical senior, not like a rubber stamp.
Read the plan and the PR description before the polish. Check for duplicated helpers, weakened tests, surprise dependencies, and unhappy paths. Green CI is necessary. It is not a personality test for the change.
6. Match model autonomy to task risk.
Longer-horizon models and coding agents are great for well-scoped chores with executable done conditions. Cross-cutting refactors still need a human architect in the loop. Faster pairs still need a lead.
What stays true
None of this is an argument against Copilot. I use AI assistants the way I use compilers, linters, and CI: leverage with eyes open. The win is compressing blank-page time and catching mechanical issues earlier. The tax is still verification, judgment, and ownership.
If your org turns on Copilot approvals this month, write the policy in plain language: which repos, which paths, which exceptions, who is accountable when a bad merge ships. Put it next to the branch protection screenshot. Then run a small canary and compare incident noise and review latency before you widen the aperture.
AI can help write the change. AI can help comment on the change. A human still needs to own the merge when the blast radius is real.
Loved it? Drop a comment with what your team learned if you already flipped the toggle. Support the shenanigans on Patreon or buy me a coffee, and follow AttuneIT on YouTube, X, and Facebook. Let’s make tech less scary and more awesome.