GH-600 Questions and Answers

A fine-grained PAT restricted to product-api provides an enforceable repository-level authorization boundary for agent1. GitHub fine-grained personal access tokens can be limited to selected repositories and assigned only the repository permissions required by the workload. Consequently, even if agent1 attempts to access billing-service or infra-terraform, the credential does not authorize access to those repositories. GitHub specifically recommends fine-grained PATs when repository access must be restricted to particular repositories.

This directly aligns with the GH-600 objective to configure an agent ' s scope to a specific repository and define execution boundaries through repository context and permissions. Microsoft Learn defines execution context as including the repository an agent can access and emphasizes that repository scope is the first boundary limiting agent behavior.

Option A provides behavioral guidance but is not a security authorization boundary. Option B controls the permissions available to the workflow token but does not, by itself, establish the required cross-repository credential restriction. Option D only prevents certain push operations; it does not stop agent1 from reading or otherwise accessing the other repositories.

Study Guide Reference Topics: Implement Tool Use and Environment Interaction → execution context and boundaries; repository-specific agent scope; tool permissions; least-privilege authentication.

The tasks.md file is the execution-tracking document for the upgrade scenario. It records individual tasks, their validation criteria, and their completion status. Microsoft’s upgrade walkthrough specifically directs users to review this file when checking the status of every upgrade step.

A task can include several concrete verification activities, such as restoring dependencies, building the solution, correcting compilation errors, running the test suite, and rerunning tests after fixes. Reviewing these entries reveals whether implementation has merely been attempted or has satisfied the defined checks.

The assessment identifies upgrade issues and scope; it does not serve as the live record of completed work. A plan describes intended actions and ordering, which also differs from evidence that execution and testing succeeded.

The phrase “before App1 is upgraded” requires temporal care. Before execution, tasks.md identifies the steps and checks that must be performed. It cannot prove that future tests have already passed. Completion and test results become available as the agent executes and updates the tasks.

Study-guide topics: execution validation, task status, and acceptance criteria. Reference: Microsoft Learn—Execute and verify a Copilot upgrade .

===============

The API key should be stored as a secret in the Copilot environment and referenced by name from the MCP configuration. This keeps the secret value out of repository files, agent prompts, pull requests, and ordinary workflow output while allowing the MCP server to receive the required credential at runtime.

A plaintext key in a configuration file is unacceptable because repository history, forks, logs, and code review systems can expose it. A Codespaces user secret is scoped to a user development environment and does not provide the intended runtime secret for the Copilot agent environment. A GitHub Actions secret is useful for workflow expressions, but the scenario requires the key to be available to the MCP server configuration itself.

The prefixed environment-secret approach creates a clear boundary: the configuration references an identifier, while the secret value is resolved only in the authorized execution environment. This supports rotation without changing tracked configuration content.

Study-guide topics: MCP authentication, secrets management, secure environment configuration, and credential isolation.

A preToolUse hook is a possible cause because it evaluates a proposed tool invocation before execution. Such a hook can inspect the tool name and arguments, identify a prohibited operation, and deny permission. A shell command containing recursive, forced deletion of an infrastructure directory is an appropriate target for this type of preventive rule.

The decisive evidence is the statement that the command was blocked because a destructive operation was detected. This describes a decision about the proposed command rather than a failure to reach a network destination. Copilot firewall controls address network access; they do not ordinarily classify local filesystem deletion commands. A postToolUse hook runs after a tool operation and therefore does not provide the same pre-execution interception.

An application installation policy governs application access or installation rather than this command-level decision. The surrounding script can treat a denied operation as a task failure and escalate it for human review, producing the displayed exit status.

The answer identifies a plausible enforcement mechanism; the log does not establish its exact implementation.

Study-guide topics: preventive guardrails, tool authorization, destructive-action detection, and escalation. Reference: GitHub Copilot—Hooks reference .

===============

Yes, Yes, Yes

Comprehensive and Detailed 150 to 250 words of Explanation From Agentic AI Developer/Course Guide/topics:

All three statements are supported by explicit operational signals in the supplied logs.

The first statement is Yes . Each relevant session records Passing 1 MCP server(s) to SDK: [github] followed by github: type=http. These entries show that the GitHub MCP server is being supplied to the agent session as an available remote MCP integration. The CLIMCPServerEnabled=false entry concerns the separate CLI MCP configuration flag and does not negate the subsequently logged GitHub server passed to the SDK.

The second statement is Yes . The logs explicitly state workspace isolation mode selected for session and indicate that worktree creation is skipped. Therefore, the selected session isolation mechanism is workspace isolation rather than a separate Git worktree.

The third statement is Yes . Two distinct entries identify new Copilot CLI sessions with isNewSession: true: one beginning with session ID de04f0fe... and another with 6852c5dc.... Later MCP/configuration events do not contain another isNewSession: true record, so the evidence shows exactly two newly started sessions.

This type of log interpretation directly maps to the GH-600 requirement to identify failures and execution characteristics by analyzing logs, traces, outputs, and workflow artifacts , and to use operational signals when evaluating multi-agent behavior.

Study Guide Reference Topics: Perform Evaluation, Error Analysis, and Tuning; log and trace analysis; execution-context evaluation; MCP observability; multi-agent session analysis.

The most effective intervention occurs before the issue becomes an executable assignment. Acceptance criteria define the observable conditions that constitute success, while implementation directions establish boundaries and clarify how the work should proceed. Providing both before assignment reduces the need for the agent to infer missing requirements during planning.

Applied to this scenario, the issue should distinguish required outcomes from optional improvements and identify constraints that the implementation must respect. Where steps are ambiguous, the author should resolve the ambiguity or explicitly require clarification before execution. Reviewable criteria also give the agent and maintainers a shared basis for evaluating whether the resulting changes satisfy the original request.

Options A and D intervene after assignment or execution has begun. They may support later correction, but they do not prevent the initial plan from being based on unclear directions. Option C addresses dependency availability, which is a separate environmental concern.

The governing design principle is to make the task sufficiently definite before delegating action. Relevant curriculum topics include defining inputs and success criteria, validating agent plans, and separating preparation from execution.

The mcp-servers property connects a custom agent to the Model Context Protocol servers required for its planned work. MCP configuration makes defined external tools and services available to the agent in a controlled, declarative manner.

Adding a broad natural-language instruction such as “Use all available tools” does not configure a server connection, authenticate a tool, or define which external capabilities are available. It is also poor least-privilege design because it encourages unrestricted tool use without establishing a technical permission boundary.

Setting tools: [] removes all configured tools and would prevent the agent from using required capabilities. Deleting the tools line could cause the agent to inherit or expose a broader default tool set than intended. Repository-wide instructions can guide behavior, but they do not replace the agent-specific configuration needed to associate MCP servers with that agent.

A well-designed configuration identifies only the MCP servers necessary for the role, supplies secrets through approved environment mechanisms, and limits the resulting tools to the agent’s defined task.

Study-guide topics: MCP integration, agent tool configuration, and least-privilege environment access.

===============

Target

Selection

Dropdown 1

' search '

Dropdown 2

' read '

The visible configuration describes an implementation planner. Providing search and read supports the information-gathering work needed to produce a technically grounded plan: locating relevant code and inspecting its contents. The listed documentation tools supplement repository context with external technical reference material.

This tool selection also establishes a practical boundary between planning and implementation. A planner can explain proposed changes and produce Markdown in its response without needing permission to modify repository files. Granting editing or command-execution capabilities would expand its authority beyond the visible planning role.

The distinction between generating Markdown and saving a Markdown file is important. The selected tools support producing a plan in conversation. If the requirements instead demanded that the planner write that plan directly into the repository, an appropriate file-writing capability or a separate persistence step would be necessary.

Tool names must also resolve to capabilities available in the configured environment. Merely listing a documentation tool does not install or authenticate its MCP server.

Study-guide topics: tool selection, least-privilege planning, and environment capabilities. Reference: VS Code—Use tools with agents .

The agent session log is the appropriate starting point when the reported problem concerns an agent’s interaction, execution sequence, or tool activity within the development environment. It provides information closer to the failing behavior than repository-level workflow usage statistics.

A useful investigation establishes what the agent was asked to do, which operations it attempted, what responses those operations returned, and where progress stopped or diverged from the intended result. Session diagnostics can help distinguish an instruction problem from an unavailable tool, a rejected operation, or an execution error. VS Code also provides detailed chat debugging facilities for inspecting interactions and diagnosing failures.

GitHub Actions usage metrics primarily describe workflow consumption. Runner logs are relevant when evidence points to a hosted workflow or runner problem. The token permissions block becomes relevant when the failure concerns authorization to a GitHub resource. None should be assumed to be the root cause before examining the reported execution.

The PDF selects B; the underlying Dev1 incident description is not included, so this selection assumes a session-level agent issue.

Study-guide topics: diagnostic evidence, tool-call inspection, and failure localization. Reference: VS Code—Debug chat interactions .

The intended distinction is between delegating analytical work and allowing the agent to provide the final approval of its own work. Approving all Git commits would remove independent review of changes that include security-sensitive remediation and compatibility modifications across multiple projects.

Human validation of assessment.md is similarly important because the assessment determines the scope and direction of the upgrade. Incorrectly classified dependencies, missed projects, or an incomplete vulnerability analysis can propagate into the implementation plan. Microsoft’s guidance explicitly recommends reviewing the assessment for missing projects, problematic dependencies, and application-specific concerns before proceeding.

Generating the assessment and checking whether a task file exists are appropriate automated activities. An agent can also inspect the plan’s dependency relationships and flag potential ordering problems. Such assistance does not transfer final accountability for accepting the plan.

The wording should not be interpreted as prohibiting automated assessment validation. Agents can run valuable consistency checks; the unsafe delegation is treating those checks as sufficient independent approval of their own conclusions.

Study-guide topics: human oversight, independent validation, and approval boundaries. Reference: Microsoft Learn—Best practices for GitHub Copilot upgrade .

===============

Copilot memory is an organization-level capability. Configuring it through the organization’s Copilot settings establishes the governance boundary, availability, and policy controls consistently for the developers and repositories covered by that organization.

Personal settings are unsuitable because they create inconsistent behavior between developers and do not provide centralized administration. A repository-level configuration can supply repository instructions and scoped context, but it does not replace the organization-level control that enables and governs the memory capability. An individual agent profile defines role behavior, tool access, prompts, and delegation settings; it is not the tenant-level location for enabling Copilot memory.

Organization configuration is particularly important when agents must retain approved context, recurring preferences, and workflow guidance across sessions without each developer configuring behavior independently. Central governance also allows administrators to maintain predictable controls over which organizational information is available to Copilot.

Study-guide topics: organizational governance, persistent context, and centralized agent configuration.