What each permission level auto-runs

Copilot’s autonomy is not a single on/off switch. The chat.permissions.default setting - the permission level - offers a small set of answers to one question: how much can the agent run without checking with me first? As of September 2026 the levels are three, and one adjacent feature gets mistaken for a fourth.

The three levels

• Manual permissions (the default) - safe, read-only actions run on their own; consequential actions stop for your confirmation. Reading files and searching the codebase happen without interruption; potentially destructive actions - file edits, terminal commands, external tool calls - are held for a yes, governed by tool approvals (the per-tool rules that decide which actions pause). This is the cautious setting, and the one you want when a wrong action does real damage.
• Assisted permissions (experimental) - a Large Language Model judges each requested action and decides, per action, whether it is safe to auto-approve. Instead of prompting on every consequential action, it prompts on the ones its judgment flags. Being experimental, treat it as something to try on low-stakes work, not a setting to standardize a team on. It is off until you enable chat.assistedPermissions.enabled, needs Folder isolation, and is not available in Local harness sessions (as of October 2026).
• Allow all - auto-approve all tool calls. Copilot stops asking and just runs, terminal commands included. You are trading the checkpoint for speed. On code that is cheap to fix forward, that trade is often worth it; on a shared library, it is not.

(The approvals documentation tracks the current set, each level’s exact behavior, and Autopilot - including the Advanced autopilot preview label.)

Notice these are not about capability - the Agent role (Copilot’s role that edits files and runs commands, rather than only answering) can do the same things at every level. They are about latitude: the same agent, on the same task, with progressively less of you in the loop.

Autopilot is an agent mode, not a level

One more thing appears in the same corner of the product and gets misfiled as a permission level: Autopilot. It is an agent mode - a way for the agent to run - not a value of chat.permissions.default in Copilot harness sessions (in Local harness sessions it is a permission level). What puts it in this conversation is that, like Allow all, it skips confirmation for potentially destructive actions including file edits, terminal commands, and external tool calls, and it also answers for itself the questions Copilot would otherwise pause to ask, so it runs all the way to completion without coming back. Useful to know exists; not where you point your highest-stakes work, because unlike Allow all nothing returns the task to you until the whole run is done. (A separate, newer “Advanced autopilot” carries a preview label; base Autopilot does not.)

It persists

You set the level once and it sticks - chat.permissions.default is a VS Code setting, so it behaves like the rest of your settings and governs what new sessions default to. That is a convenience and a trap worth naming now: the dial you left loose for yesterday’s low-stakes work is still loose when today’s high-stakes work begins. Part of the discipline this chapter teaches is checking the dial before a consequential change, not assuming it is where you would want it.

What the levels govern

At the manual default, the consequential actions pause; at Allow all and in Autopilot, they flow. Which specific actions pause - an edit, a command, a tool call - is what the tool-approval rules decide, and the checkpoint that results is the single most important control you have on shared code. For a consequential change to a library other services import - this course’s shared-lib, or any shared library you own - the choice is already made: Manual permissions, every consequential action reviewed. Next, the moment where that pays off. The checkpoint - reviewing risky commands.