Copilot only does work that has been assigned to it by a developer, and all the code that the agent writes has to go through a pull request before it can be merged. In fact, Copilot has no write access to GitHub at all, except to push to its own branch.

That ensures that all of Copilot's code goes through our normal review process which requires a review from an independent human.