approveAll cannot be used when managed settings are enabled

Error message

approveAll cannot be used when managed settings are enabled

What it means

The built-in PermissionHandler.ApproveAll refuses to auto-approve when managed settings are enabled on the invocation. Managed settings imply policy-controlled approvals, so blanket approval would bypass them; the handler returns an error instead.

Solutions

Install a permission handler that respects ManagedSettingsEnabled (e.g., delegate to managed approval flows) when managed settings are on
Disable managed settings if blanket approval is truly intended (and permitted)
Inspect invocation.ManagedSettingsEnabled in your handler and branch before approving

Example fix

// before
client.SetPermissionHandler(copilot.PermissionHandler.ApproveAll)
// after
client.SetPermissionHandler(func(req copilot.PermissionRequest, inv copilot.PermissionInvocation) (copilot.rpc.PermissionDecision, error) {
    if inv.ManagedSettingsEnabled {
        return &copilot.rpc.PermissionDecisionNoResult{}, nil
    }
    return copilot.PermissionHandler.ApproveAll(req, inv)
})

Defensive patterns

Strategy: try-catch

Validate before calling

if invocation.ManagedSettingsEnabled && handler == copilot.PermissionHandler.ApproveAll {
    return fmt.Errorf("ApproveAll is incompatible with managed settings")
}

Try / catch

decision, err := handler(req, inv)
if err != nil && strings.Contains(err.Error(), "approveAll cannot be used when managed settings are enabled") {
    decision, err = managedAwareHandler(req, inv)
}

Prevention

Check invocation.ManagedSettingsEnabled before choosing a handler
Use managed-aware permission handlers in enterprise environments
Test permission flows with managed settings both on and off

When it happens

Trigger: Registering/using ApproveAll as the permission handler for a client/invocation where invocation.ManagedSettingsEnabled is true, and a permission request arrives.

Common situations: Enterprise-managed Copilot configurations with admin-enforced settings; reusing a default handler across environments where managed settings differ; forgetting to install a managed-aware handler.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of github/copilot-sdk@cd8cf15dc3 (2026-09-09). Data as JSON: /api/errors/708e7589e80144d5. Report an issue: GitHub.

Appendix: source

Thrown at go/permissions.go:72

// unwrapped.
func splitAttribution(result rpc.PermissionDecision) (rpc.PermissionDecision, *rpc.PermissionDecisionContext) {
	switch attributed := result.(type) {
	case *AttributedPermissionResult:
		return attributed.PermissionDecision, attributed.DecisionContext
	case AttributedPermissionResult:
		return attributed.PermissionDecision, attributed.DecisionContext
	}
	return result, nil
}

// PermissionHandler provides pre-built OnPermissionRequest implementations.
var PermissionHandler = struct {
	// ApproveAll approves permission requests when managed settings are disabled.
	ApproveAll PermissionHandlerFunc
}{
	ApproveAll: func(request PermissionRequest, invocation PermissionInvocation) (rpc.PermissionDecision, error) {
		if invocation.ManagedSettingsEnabled {
			return nil, errors.New("approveAll cannot be used when managed settings are enabled")
		}
		if request.RequiresManagedApproval() {
			return &rpc.PermissionDecisionNoResult{}, nil
		}
		return &rpc.PermissionDecisionApproveOnce{}, nil
	},
}

View on GitHub (pinned to cd8cf15dc3)