GH-600 Developing in Agentic AI Systems Question and Answers

A properly configured branch ruleset establishes enforcement outside the agent’s editable task instructions. It can require pull requests, successful checks, and appropriate reviews before changes enter protected branches. In an enterprise setup, required workflows can also be governed centrally so that changing a repository-local workflow does not remove the organization’s validation requirement.

The ruleset must be configured to preserve the intended checks. Merely creating an empty ruleset does not solve the problem, and requiring a check whose implementation the agent can freely weaken is insufficient. Protecting workflow changes through required ownership review or centrally managed validation addresses that remaining gap. The agent should not receive bypass permission for these controls.

Option A increases authority rather than constraining the unwanted behavior. Option C removes the checks that are supposed to detect defective code. Option D affects treatment of untracked files and does not prevent changes to already tracked workflow definitions.

The control cannot guarantee successful reasoning, but it can prevent acceptance of a shortcut that defeats validation.

Relevant curriculum topics are blocking prohibited actions, enforcing independent controls, and correcting undesirable behavior identified through evaluation.

Allowing only read and search removes approval friction for operations that inspect repository content without modifying it. The edit and execute tools remain available in the agent profile, but they continue to require explicit approval because they are not included in the command’s approval bypass.

Using no option preserves the default approval behavior for all tools, including low-risk inspection tools, which does not meet the velocity requirement. Allowing all tools would remove the approval safeguard for file modifications and shell execution. Denying edit and execute prevents those tools from being used at all, rather than keeping them available under human control.

This design separates tool availability from automatic authorization. Read-only operations can proceed autonomously, while potentially impactful operations remain subject to a human decision at the point of use.

Study-guide topics: tool approval boundaries, least privilege, read-only execution, and controlled agent autonomy.

===============

Target

Value

approval_required.if

${{ needs.plan.outputs.risk != ' low ' }}

apply_auto.if

${{ needs.plan.outputs.risk == ' low ' }}

The approval job must run whenever the computed risk is not low. The expression ${{ needs.plan.outputs.risk != ' low ' }} includes both medium and high risk values, routing those plans through the protected approval environment.

The automatic application job must run only when the plan output explicitly equals low. The expression ${{ needs.plan.outputs.risk == ' low ' }} prevents the automatic path from running for medium, high, missing, or unexpected risk values.

These conditions should be evaluated from a defined output of the preceding plan job. The plan job must therefore parse plan.json, validate the risk value, and expose it through jobs. < job_id > .outputs. A malformed, empty, or unknown risk value should not fall through to automatic execution.

The environment gate supplies the human confirmation mechanism. The conditional logic only routes jobs; it does not itself create approval requirements.

Study-guide topics: risk-based routing, conditional workflow execution, protected environments, and agent autonomy controls.

===============

Requirement

Action

To allow cross-device tool access without local setup

Use a GitHub-hosted Model Context Protocol (MCP) server for cloud-based workflows.

To enable organization-wide agent tools across all Copilot environments

Enable the MCP servers in Copilot policy.

A GitHub-hosted MCP server provides cloud-based tools that are not dependent on a developer’s local Visual Studio Code installation. This enables the same service capability to be used from github.com and from supported development environments without requiring each device to run or configure a local server.

Enabling MCP servers through Copilot policy establishes organization-wide governance over which MCP capabilities are available. This is the appropriate administrative control when the organization needs consistent access across Copilot environments.

Running an MCP server in Docker can support local development, but it does not satisfy the requirement for access from any device without local setup. Changing a Copilot mode affects interaction behavior rather than tool availability. Restricting toolsets can reduce exposure, but it does not make an MCP server available across environments.

Study-guide topics: MCP hosting, cross-environment tools, organizational policy, and agent portability.

===============

Signal

Execution context

The eyes emoji reaction appears on the issue.

The agent acknowledges the assignment and will create the draft pull request.

The pull request timeline shows Copilot started work.

The agent session is actively running and generating live logs.

A draft pull request exists, but GitHub Actions checks are not running.

A human must manually approve and run the workflows.

The eyes reaction signals that Copilot has acknowledged the issue assignment. It is an early lifecycle indicator that the coding agent accepted the work and will begin its workflow.

A pull-request timeline event showing that Copilot started work indicates an active session. This is the appropriate place to observe ongoing status updates and session activity while the agent creates or revises the draft pull request.

When the draft pull request exists but its workflows have not started, the likely state is pending manual authorization. GitHub can require a user with write access to approve and run workflows associated with the pull request, especially where the workflow originates from an untrusted context or requires explicit approval.

These indicators are complementary: issue reactions establish acknowledgement, timeline events show active execution, and inactive checks can identify an approval gate rather than an agent failure.

Study-guide topics: asynchronous coding agents, execution signals, workflow approval, and pull-request observability.

===============

Hook target

Value

Security-check command

preToolUse

Build-results logging command

postToolUse

Tool-usage logging command

postToolUse

preToolUse is the correct hook for evaluating proposed tool usage before it executes. A security-check command at this lifecycle point can inspect the tool request and permit, deny, or require approval before an effect occurs.

Both build-result logging and tool-usage logging occur after an operation has completed, so both use postToolUse. The hook can capture the result, exit status, and other relevant metadata for audit or diagnostic purposes.

A session-start or session-end hook is too broad because it runs at the boundary of the full session rather than around an individual tool invocation. An error-occurrence hook reacts to failures but does not provide routine after-execution logging for successful tool usage.

The same hook type can be used multiple times in a configuration. Each entry can call a different command for a distinct purpose, such as one record for build results and another for general tool-usage telemetry.

Study-guide topics: pre-execution controls, post-execution telemetry, hooks, and audit evidence.

===============

CodeQL findings and secret-detection results are the intended selections. CodeQL analyzes code for patterns associated with vulnerabilities and programming errors. Secret scanning identifies sensitive material, including supported credential and token patterns, that may have been introduced into the generated changes. Both provide concrete security evidence that a reviewer can evaluate alongside the proposed fix.

Linting generally evaluates coding conventions and selected correctness rules; a generic linting failure is not necessarily a security finding. Median time to merge measures delivery performance rather than the security of a particular change.

The wording of option D creates an important technical distinction. Dependency vulnerability detection is also a genuine automated security signal. GitHub explicitly documents dependency analysis alongside CodeQL and secret scanning in the coding agent’s security checks. Repository-level dependency alerts, however, may concern existing vulnerabilities rather than changes introduced by this pull request. B and C are the clearest intended pair, but D cannot be dismissed as unrelated to security.

Reviewers should determine whether each finding applies to the proposed changes and whether the underlying vulnerability has actually been resolved.

Relevant curriculum topics are automated evaluation signals, security scanning, and evidence-based assessment of agent outputs.

Requirement

Control

Agent’s draft pull request workflow control

Approve and run the workflows from the pull request merge box.

Production deployment job control

In the deployment job, configure the required reviewers for the production environment.

Approving and running workflows from the pull request interface controls whether workflows associated with the agent’s draft pull request are allowed to begin. This provides the required human authorization before CI executes in that context.

Required reviewers on the production environment protect the deployment job itself. When the workflow reaches that environment, GitHub pauses the job until an authorized reviewer explicitly approves it. The approval is therefore applied at the production boundary, independently from the earlier pull-request workflow authorization.

A concurrency group controls overlap but does not require human approval. A custom deployment protection rule may be useful for specialized external validation, but it is not required by the stated scenario. Commit signing and run-summary inspection do not control the requested execution gates.

Study-guide topics: approval gates, protected environments, draft pull-request workflows, and production accountability.

===============

Separate branches isolate each agent’s proposed changes and allow the team to inspect them independently. Adding a required status check for file-level overlap detects conflicting modifications before either pull request is merged, preventing one agent’s work from silently overwriting another’s changes.

A read-only tool configuration prevents both agents from making required changes, so it avoids conflict by eliminating implementation capability rather than controlling it. CODEOWNERS approval adds review accountability for a specific file but does not automatically detect overlap between independent agent outputs. A single concurrency group serializes entire workflows and reduces throughput even where the agents work on unrelated files.

The selected solution maintains parallel development while creating a merge-time control for the actual risk: overlapping file changes. It also produces reviewable evidence of the overlap check in pull request status results.

Branch isolation does not eliminate semantic conflicts, such as incompatible API assumptions. Teams should therefore combine overlap detection with normal pull request review and integration testing.

Study-guide topics: parallel agent coordination, branch isolation, merge controls, and conflict detection.

The mcp-servers property connects a custom agent to the Model Context Protocol servers required for its planned work. MCP configuration makes defined external tools and services available to the agent in a controlled, declarative manner.

Adding a broad natural-language instruction such as “Use all available tools” does not configure a server connection, authenticate a tool, or define which external capabilities are available. It is also poor least-privilege design because it encourages unrestricted tool use without establishing a technical permission boundary.

Setting tools: [] removes all configured tools and would prevent the agent from using required capabilities. Deleting the tools line could cause the agent to inherit or expose a broader default tool set than intended. Repository-wide instructions can guide behavior, but they do not replace the agent-specific configuration needed to associate MCP servers with that agent.

A well-designed configuration identifies only the MCP servers necessary for the role, supplies secrets through approved environment mechanisms, and limits the resulting tools to the agent’s defined task.

Study-guide topics: MCP integration, agent tool configuration, and least-privilege environment access.

===============

The API key should be stored as a secret in the Copilot environment and referenced by name from the MCP configuration. This keeps the secret value out of repository files, agent prompts, pull requests, and ordinary workflow output while allowing the MCP server to receive the required credential at runtime.

A plaintext key in a configuration file is unacceptable because repository history, forks, logs, and code review systems can expose it. A Codespaces user secret is scoped to a user development environment and does not provide the intended runtime secret for the Copilot agent environment. A GitHub Actions secret is useful for workflow expressions, but the scenario requires the key to be available to the MCP server configuration itself.

The prefixed environment-secret approach creates a clear boundary: the configuration references an identifier, while the secret value is resolved only in the authorized execution environment. This supports rotation without changing tracked configuration content.

Study-guide topics: MCP authentication, secrets management, secure environment configuration, and credential isolation.

A fine-grained PAT restricted to product-api provides an enforceable repository-level authorization boundary for agent1. GitHub fine-grained personal access tokens can be limited to selected repositories and assigned only the repository permissions required by the workload. Consequently, even if agent1 attempts to access billing-service or infra-terraform, the credential does not authorize access to those repositories. GitHub specifically recommends fine-grained PATs when repository access must be restricted to particular repositories.

This directly aligns with the GH-600 objective to configure an agent ' s scope to a specific repository and define execution boundaries through repository context and permissions. Microsoft Learn defines execution context as including the repository an agent can access and emphasizes that repository scope is the first boundary limiting agent behavior.

Option A provides behavioral guidance but is not a security authorization boundary. Option B controls the permissions available to the workflow token but does not, by itself, establish the required cross-repository credential restriction. Option D only prevents certain push operations; it does not stop agent1 from reading or otherwise accessing the other repositories.

Study Guide Reference Topics: Implement Tool Use and Environment Interaction → execution context and boundaries; repository-specific agent scope; tool permissions; least-privilege authentication.

The first statement is Yes . When an MCP server is configured for a repository, GitHub Copilot cloud agents can use the enabled MCP tools autonomously during assigned tasks. GitHub specifically notes that Copilot does not request interactive approval before invoking configured MCP tools, making careful tool allowlisting and credential protection important.

The second statement is No . For repository-level MCP integration, Copilot cloud agent currently supports MCP tools , but it does not support MCP resources or MCP prompts exposed by the server. Resources and prompts are available in other MCP-capable Copilot experiences, such as IDE chat, but they are not consumed by the cloud coding agent in this configuration.

The third statement is Yes under the planned configuration. Litware requires agent1 to access all available tools . GitHub custom-agent configuration supports this by omitting the tools property or specifying tools: [ " * " ]. Likewise, an MCP server can use " * " to expose all of its tools. Consequently, newly introduced MCP1 tools fall within that wildcard authorization and become available without individually adding each tool name.

Study Guide Reference Topics: MCP tool integration, custom-agent tool configuration, autonomous tool invocation, MCP capability boundaries, and least-privilege agent execution.

The agent session log is the appropriate starting point when the reported problem concerns an agent’s interaction, execution sequence, or tool activity within the development environment. It provides information closer to the failing behavior than repository-level workflow usage statistics.

A useful investigation establishes what the agent was asked to do, which operations it attempted, what responses those operations returned, and where progress stopped or diverged from the intended result. Session diagnostics can help distinguish an instruction problem from an unavailable tool, a rejected operation, or an execution error. VS Code also provides detailed chat debugging facilities for inspecting interactions and diagnosing failures.

GitHub Actions usage metrics primarily describe workflow consumption. Runner logs are relevant when evidence points to a hosted workflow or runner problem. The token permissions block becomes relevant when the failure concerns authorization to a GitHub resource. None should be assumed to be the root cause before examining the reported execution.

The PDF selects B; the underlying Dev1 incident description is not included, so this selection assumes a session-level agent issue.

Study-guide topics: diagnostic evidence, tool-call inspection, and failure localization. Reference: VS Code—Debug chat interactions .

Copilot memory is an organization-level capability. Configuring it through the organization’s Copilot settings establishes the governance boundary, availability, and policy controls consistently for the developers and repositories covered by that organization.

Personal settings are unsuitable because they create inconsistent behavior between developers and do not provide centralized administration. A repository-level configuration can supply repository instructions and scoped context, but it does not replace the organization-level control that enables and governs the memory capability. An individual agent profile defines role behavior, tool access, prompts, and delegation settings; it is not the tenant-level location for enabling Copilot memory.

Organization configuration is particularly important when agents must retain approved context, recurring preferences, and workflow guidance across sessions without each developer configuring behavior independently. Central governance also allows administrators to maintain predictable controls over which organizational information is available to Copilot.

Study-guide topics: organizational governance, persistent context, and centralized agent configuration.

Repository custom agent profiles belong in .github/agents/ and use Markdown files with agent configuration and instructions. When the intended changes concern the agents’ roles, available tools, or operating guidance, these profiles are the appropriate implementation point.

An agent profile provides a durable definition that can be shared with other repository contributors. Keeping that definition under version control makes changes reviewable and enables the team to associate a particular agent configuration with the code revision used during evaluation. This is useful when diagnosing why an agent’s behavior changed after its instructions or capabilities were modified.

Editor settings and MCP connection settings address different concerns. They can affect the environment in which an agent operates, but they do not replace the agent’s own profile. Changing a server connection is appropriate for transport or authentication requirements; changing an agent profile is appropriate for agent behavior and capability selection.

The source selects C. Its applicability depends on the omitted planned changes actually concerning custom agent configuration.

Study-guide topics: agent profiles, configuration management, and SDLC traceability. Reference: GitHub—Creating custom agents .

===============

Target

Selection

Dropdown 1

' search '

Dropdown 2

' read '

The visible configuration describes an implementation planner. Providing search and read supports the information-gathering work needed to produce a technically grounded plan: locating relevant code and inspecting its contents. The listed documentation tools supplement repository context with external technical reference material.

This tool selection also establishes a practical boundary between planning and implementation. A planner can explain proposed changes and produce Markdown in its response without needing permission to modify repository files. Granting editing or command-execution capabilities would expand its authority beyond the visible planning role.

The distinction between generating Markdown and saving a Markdown file is important. The selected tools support producing a plan in conversation. If the requirements instead demanded that the planner write that plan directly into the repository, an appropriate file-writing capability or a separate persistence step would be necessary.

Tool names must also resolve to capabilities available in the configured environment. Merely listing a documentation tool does not install or authenticate its MCP server.

Study-guide topics: tool selection, least-privilege planning, and environment capabilities. Reference: VS Code—Use tools with agents .

Yes, Yes, Yes

Comprehensive and Detailed 150 to 250 words of Explanation From Agentic AI Developer/Course Guide/topics:

All three statements are supported by explicit operational signals in the supplied logs.

The first statement is Yes . Each relevant session records Passing 1 MCP server(s) to SDK: [github] followed by github: type=http. These entries show that the GitHub MCP server is being supplied to the agent session as an available remote MCP integration. The CLIMCPServerEnabled=false entry concerns the separate CLI MCP configuration flag and does not negate the subsequently logged GitHub server passed to the SDK.

The second statement is Yes . The logs explicitly state workspace isolation mode selected for session and indicate that worktree creation is skipped. Therefore, the selected session isolation mechanism is workspace isolation rather than a separate Git worktree.

The third statement is Yes . Two distinct entries identify new Copilot CLI sessions with isNewSession: true: one beginning with session ID de04f0fe... and another with 6852c5dc.... Later MCP/configuration events do not contain another isNewSession: true record, so the evidence shows exactly two newly started sessions.

This type of log interpretation directly maps to the GH-600 requirement to identify failures and execution characteristics by analyzing logs, traces, outputs, and workflow artifacts , and to use operational signals when evaluating multi-agent behavior.

Study Guide Reference Topics: Perform Evaluation, Error Analysis, and Tuning; log and trace analysis; execution-context evaluation; MCP observability; multi-agent session analysis.

Statement

Answer

The .github/upgrades folder contains all the required reports.

Yes*

The tasks.md file contains all the changes and their implementation status.

Yes

The assessment.md file lists all the breaking changes and their implementation status.

No

*For the standard upgrade-generated reports, including their scenario subfolder.

GitHub Copilot upgrade stores its generated workflow state under .github/upgrades/{scenarioId}. This includes the assessment, plan, task tracking, and related scenario records. Consequently, the parent .github/upgrades folder contains the standard upgrade reports through its scenario subdirectories. The PDF’s marked “No” for the first statement conflicts with that documented storage structure unless an additional, unstated reporting requirement applies.

The tasks.md file tracks execution progress. It identifies the upgrade tasks and records their implementation status as work proceeds. In this context, “all the changes” means the tracked upgrade tasks, rather than a complete line-by-line replacement for the Git diff.

The assessment has a different purpose. It describes the application’s compatibility issues, breaking changes, dependencies, and upgrade scope. It is not the authoritative execution-status record. Identifying a breaking change in an assessment does not establish that its remediation has been implemented or validated.

These files collectively separate the original findings, planned response, and execution progress, making the upgrade reviewable across sessions.

Study-guide topics: durable workflow state, progress tracking, and generated artifacts. Reference: Microsoft Learn—GitHub Copilot upgrade state management .

===============