github/copilot-sdk · error · RuntimeError

approve_all cannot be used when managed settings are enabled

Error message

approve_all cannot be used when managed settings are enabled

What it means

PermissionHandler.approve_all() blanket-approves tool/permission requests, but when the session reports `managed_settings_enabled` (enterprise/admin-managed policy), auto-approval is forbidden by policy. The library raises this RuntimeError because approve_all would bypass controls the administrator has locked down; in that mode only managed (interactive/admin-approved) decisions are honored.

Solutions

1. Switch to an interactive permission handler (e.g. one that returns PermissionDecisionApproveOnce/managed approval) when managed settings are enabled.
2. Check `invocation.get('managed_settings_enabled')` before registering approve_all and choose the compliant handler instead.
3. Ask the administrator to exempt your workflow from managed settings if auto-approval is genuinely required.

Example fix

// before
session.permission_handler = PermissionHandler.approve_all

// after
def pick_handler(invocation):
    if invocation.get("managed_settings_enabled", False):
        return managed_interactive_handler
    return PermissionHandler.approve_all

if invocation.get("managed_settings_enabled", False):
    handler = managed_interactive_handler
else:
    handler = PermissionHandler.approve_all

def allows_auto_approval(invocation) -> bool:
    return not invocation.get("managed_settings_enabled", False)

try:
    result = PermissionHandler.approve_all(request, invocation)
except RuntimeError as e:
    if "managed settings" in str(e):
        result = request_managed_approval(request)
    else:
        raise

When it happens

Trigger: Configuring the session's permission handler to PermissionHandler.approve_all while connected with managed settings enabled (invocation['managed_settings_enabled'] is True); a permission request arrives and the static approve_all handler checks the invocation flags.

Common situations: Running under a GitHub Copilot enterprise/organization policy with admin-managed permissions while local code auto-approves everything; dev scripts that hardcode approve_all and break when run on managed machines.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• approveAll cannot be used when managed settings are enabled
• Checksum mismatch for
• on_permission_request must be callable when provided.
• Copilot request response start() called twice.
• Copilot request response already finished.

AI-assisted analysis of github/copilot-sdk@cd8cf15dc3 (2026-09-09). Data as JSON: /api/errors/918b66266ceb7b70. Report an issue: GitHub.

Appendix: source

Thrown at python/copilot/session.py:481

    session_id: Required[str]
    managed_settings_enabled: NotRequired[bool]


_PermissionHandlerFn = Callable[
    [PermissionRequest, PermissionInvocation],
    PermissionRequestResult
    | AttributedPermissionResult
    | Awaitable[PermissionRequestResult | AttributedPermissionResult],
]


class PermissionHandler:
    @staticmethod
    def approve_all(
        request: PermissionRequest, invocation: PermissionInvocation
    ) -> PermissionRequestResult:
        if invocation.get("managed_settings_enabled", False):
            raise RuntimeError("approve_all cannot be used when managed settings are enabled")
        if getattr(request, "managed_approval_required", False) is True:
            return PermissionNoResult()
        return PermissionDecisionApproveOnce()


# ============================================================================
# MCP Auth Types
# ============================================================================


class McpAuthWwwAuthenticateParams(TypedDict, total=False):
    """Parsed parameters from an MCP server's WWW-Authenticate response."""

    resourceMetadataUrl: str
    scope: str
    error: str

View on GitHub (pinned to cd8cf15dc3)