{"record":{"id":"918b66266ceb7b70","repo":"github/copilot-sdk","slug":"approve-all-cannot-be-used-when-managed-settings-a","errorCode":null,"errorMessage":"approve_all cannot be used when managed settings are enabled","messagePattern":"approve_all cannot be used when managed settings are enabled","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"python/copilot/session.py","lineNumber":481,"sourceCode":"    session_id: Required[str]\n    managed_settings_enabled: NotRequired[bool]\n\n\n_PermissionHandlerFn = Callable[\n    [PermissionRequest, PermissionInvocation],\n    PermissionRequestResult\n    | AttributedPermissionResult\n    | Awaitable[PermissionRequestResult | AttributedPermissionResult],\n]\n\n\nclass PermissionHandler:\n    @staticmethod\n    def approve_all(\n        request: PermissionRequest, invocation: PermissionInvocation\n    ) -> PermissionRequestResult:\n        if invocation.get(\"managed_settings_enabled\", False):\n            raise RuntimeError(\"approve_all cannot be used when managed settings are enabled\")\n        if getattr(request, \"managed_approval_required\", False) is True:\n            return PermissionNoResult()\n        return PermissionDecisionApproveOnce()\n\n\n# ============================================================================\n# MCP Auth Types\n# ============================================================================\n\n\nclass McpAuthWwwAuthenticateParams(TypedDict, total=False):\n    \"\"\"Parsed parameters from an MCP server's WWW-Authenticate response.\"\"\"\n\n    resourceMetadataUrl: str\n    scope: str\n    error: str\n\n","sourceCodeStart":463,"sourceCodeEnd":499,"githubUrl":"https://github.com/github/copilot-sdk/blob/cd8cf15dc3f9e762615790aaed0a771a0f392755/python/copilot/session.py#L463-L499","documentation":"PermissionHandler.approve_all() blanket-approves tool/permission requests, but when the session reports `managed_settings_enabled` (enterprise/admin-managed policy), auto-approval is forbidden by policy. The library raises this RuntimeError because approve_all would bypass controls the administrator has locked down; in that mode only managed (interactive/admin-approved) decisions are honored.","triggerScenarios":"Configuring the session's permission handler to PermissionHandler.approve_all while connected with managed settings enabled (invocation['managed_settings_enabled'] is True); a permission request arrives and the static approve_all handler checks the invocation flags.","commonSituations":"Running under a GitHub Copilot enterprise/organization policy with admin-managed permissions while local code auto-approves everything; dev scripts that hardcode approve_all and break when run on managed machines.","solutions":["Switch to an interactive permission handler (e.g. one that returns PermissionDecisionApproveOnce/managed approval) when managed settings are enabled.","Check `invocation.get('managed_settings_enabled')` before registering approve_all and choose the compliant handler instead.","Ask the administrator to exempt your workflow from managed settings if auto-approval is genuinely required."],"exampleFix":"// before\nsession.permission_handler = PermissionHandler.approve_all\n\n// after\ndef pick_handler(invocation):\n    if invocation.get(\"managed_settings_enabled\", False):\n        return managed_interactive_handler\n    return PermissionHandler.approve_all","handlingStrategy":"validation","validationCode":"if invocation.get(\"managed_settings_enabled\", False):\n    handler = managed_interactive_handler\nelse:\n    handler = PermissionHandler.approve_all","typeGuard":"def allows_auto_approval(invocation) -> bool:\n    return not invocation.get(\"managed_settings_enabled\", False)","tryCatchPattern":"try:\n    result = PermissionHandler.approve_all(request, invocation)\nexcept RuntimeError as e:\n    if \"managed settings\" in str(e):\n        result = request_managed_approval(request)\n    else:\n        raise","preventionTips":["Check managed_settings_enabled before installing an auto-approve handler.","Prefer interactive/managed approval handlers in enterprise environments.","Test permission flows with managed settings both enabled and disabled."],"tags":["permissions","policy","security","python","copilot"],"backgroundTag":"permission-denied","analyzedSha":"cd8cf15dc3f9e762615790aaed0a771a0f392755","analyzedAt":"2026-09-09T18:32:31.973Z","contentChangedAt":"2026-09-09T18:32:31.973Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}