Copilot model access can now be audited through an API

When two people maintaining the same creator website see different models in Copilot, another model announcement will not explain the difference. Their access rules might. GitHub’s October 19 update adds generally available REST reads and updates for model policies at enterprise, enterprise-team, agent-app and organization levels. API announcement.

For an agency managing several projects, this offers a way to compare configured availability without manually opening every settings screen. It is a new administrative interface, separate from the older models retired on October 19. It does not introduce another coding model or announce a price change.

An enabled setting is only part of the answer

The enterprise REST reference exposes model policy, enterprise policy and whether a setting is editable. GitHub explicitly says the app-policy response is not a final access decision for an individual user. Locked models cannot be changed at that layer. Reading and writing also require different permissions.

For example, a proposed audit could pick one approved model, collect the relevant settings read-only and compare them with the team's intended access. A mismatch should prompt an explanation of inheritance before a proposed change. Finish by checking the actual model selector for the affected workflow. We have not executed this audit or changed an account.

That makes a useful distinction between “the setting was saved” and “the person can resume the task.” A response from one layer cannot establish both.

Keep the current governance mode in view

The model-management guide describes organization-based control as the default and enterprise teams mode as an opt-in preview. API general availability does not make that mode generally available too. In teams mode, organization model settings are deactivated, and teams cannot override a model disabled at enterprise level.

A solo creator using a personal account has no reason to build this administrative process for one project. A team investigating repeated access mismatches can start with a read-only inventory and one concrete case, while keeping policy changes under its normal approval process. Our coding-agent workflow guide helps define the task the restored access needs to support.