What changed
GitHub’s 27 October announcement introduces organisation-installed GitHub Apps as a public-preview identity for Copilot SDK requests. A service can operate without borrowing an employee’s signed-in credentials. Usage belongs to the organisation that owns the installation.
This matters to teams running background agents or external CI services. Authentication now has an explicit organisational owner, but that does not create a free service or a separate spending allowance.
The permission name is not a cost limit
The administrator documentation says the Copilot Requests organisation permission uses a read-only setting yet authorises consumption of AI credits. Business or Enterprise organisation owners can manage access. Personal-account and enterprise-level installations are outside this authentication path.
Spending controls apply at organisation level: the documentation says an individual app or installation cannot have its own budget. An alert-only budget does not stop requests. Check whether the organisation’s budget is configured to stop additional usage.
App attribution is available in exported usage CSVs through app_client_id, rather than the AI usage screen. Suspending or uninstalling the app can stop its access, and also affects its other organisation permissions.
Two runtime details to check
Installation tokens expire after one hour. The SDK documentation requires renewal and the appropriate client or runtime restart. Disabling logged-in-user discovery also disables environment-token discovery, so the documented explicit token option matters.
GitHub Actions has a separate built-in-token route with different policy requirements. Do not copy the external-service setup into an Actions job and assume both paths have the same switches.
Before enabling a background agent
Record the owning organisation, permitted models, budget behaviour, token-renewal owner and person able to stop the installation. These are proposed checks, not a completed deployment.
Compare the distinction with Cursor’s deployment roles, read the Copilot plan profile, or use The Drop’s permissions worksheet. Subscription prices have not been rechecked for this announcement.
Sources and review scope
- GitHub announcement · 27 October
- SDK authentication and token renewal
- Organisation access and billing limits
- Dated source receipt
This is a documentation report. It does not establish performance, security or reliability in your environment.