{"record":{"id":"708e7589e80144d5","repo":"github/copilot-sdk","slug":"approveall-cannot-be-used-when-managed-settings-ar-708e75","errorCode":null,"errorMessage":"approveAll cannot be used when managed settings are enabled","messagePattern":"approveAll cannot be used when managed settings are enabled","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"go/permissions.go","lineNumber":72,"sourceCode":"// unwrapped.\nfunc splitAttribution(result rpc.PermissionDecision) (rpc.PermissionDecision, *rpc.PermissionDecisionContext) {\n\tswitch attributed := result.(type) {\n\tcase *AttributedPermissionResult:\n\t\treturn attributed.PermissionDecision, attributed.DecisionContext\n\tcase AttributedPermissionResult:\n\t\treturn attributed.PermissionDecision, attributed.DecisionContext\n\t}\n\treturn result, nil\n}\n\n// PermissionHandler provides pre-built OnPermissionRequest implementations.\nvar PermissionHandler = struct {\n\t// ApproveAll approves permission requests when managed settings are disabled.\n\tApproveAll PermissionHandlerFunc\n}{\n\tApproveAll: func(request PermissionRequest, invocation PermissionInvocation) (rpc.PermissionDecision, error) {\n\t\tif invocation.ManagedSettingsEnabled {\n\t\t\treturn nil, errors.New(\"approveAll cannot be used when managed settings are enabled\")\n\t\t}\n\t\tif request.RequiresManagedApproval() {\n\t\t\treturn &rpc.PermissionDecisionNoResult{}, nil\n\t\t}\n\t\treturn &rpc.PermissionDecisionApproveOnce{}, nil\n\t},\n}\n","sourceCodeStart":54,"sourceCodeEnd":80,"githubUrl":"https://github.com/github/copilot-sdk/blob/cd8cf15dc3f9e762615790aaed0a771a0f392755/go/permissions.go#L54-L80","documentation":"The built-in PermissionHandler.ApproveAll refuses to auto-approve when managed settings are enabled on the invocation. Managed settings imply policy-controlled approvals, so blanket approval would bypass them; the handler returns an error instead.","triggerScenarios":"Registering/using ApproveAll as the permission handler for a client/invocation where invocation.ManagedSettingsEnabled is true, and a permission request arrives.","commonSituations":"Enterprise-managed Copilot configurations with admin-enforced settings; reusing a default handler across environments where managed settings differ; forgetting to install a managed-aware handler.","solutions":["Install a permission handler that respects ManagedSettingsEnabled (e.g., delegate to managed approval flows) when managed settings are on","Disable managed settings if blanket approval is truly intended (and permitted)","Inspect invocation.ManagedSettingsEnabled in your handler and branch before approving"],"exampleFix":"// before\nclient.SetPermissionHandler(copilot.PermissionHandler.ApproveAll)\n// after\nclient.SetPermissionHandler(func(req copilot.PermissionRequest, inv copilot.PermissionInvocation) (copilot.rpc.PermissionDecision, error) {\n    if inv.ManagedSettingsEnabled {\n        return &copilot.rpc.PermissionDecisionNoResult{}, nil\n    }\n    return copilot.PermissionHandler.ApproveAll(req, inv)\n})","handlingStrategy":"try-catch","validationCode":"if invocation.ManagedSettingsEnabled && handler == copilot.PermissionHandler.ApproveAll {\n    return fmt.Errorf(\"ApproveAll is incompatible with managed settings\")\n}","typeGuard":null,"tryCatchPattern":"decision, err := handler(req, inv)\nif err != nil && strings.Contains(err.Error(), \"approveAll cannot be used when managed settings are enabled\") {\n    decision, err = managedAwareHandler(req, inv)\n}","preventionTips":["Check invocation.ManagedSettingsEnabled before choosing a handler","Use managed-aware permission handlers in enterprise environments","Test permission flows with managed settings both on and off"],"tags":["go","permissions","security","policy"],"backgroundTag":"permission-denied","analyzedSha":"cd8cf15dc3f9e762615790aaed0a771a0f392755","analyzedAt":"2026-09-09T18:32:31.973Z","contentChangedAt":"2026-09-09T18:32:31.973Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}