GitHub has added enterprise-managed sandbox policies to Copilot in JetBrains IDEs. Administrators can centrally restrict filesystem, network, proxy, developer-tool, and macOS Keychain access, while a new CLI connection can share IDE context. The controls are useful, but the main sandbox and CLI integration are still in public preview.
The September 8, 2026 update addresses a common enterprise problem: developers can use a powerful local coding agent while administrators need enforceable limits that do not depend on each person’s settings. Managed restrictions override user configuration.
GitHub Copilot adds an enterprise sandbox to JetBrains
The sandbox policy applies to Copilot agent activity in supported JetBrains environments. It gives administrators a centralized place to control which local and network resources the agent can reach. This changes the conversation from recommended settings to organization-managed restrictions.
That distinction matters. A user preference can be changed by the user or drift between machines. A managed restriction is intended to remain in force even when the local configuration is more permissive.
The six control areas that matter
| Control | What it can limit | First test |
|---|---|---|
| Sandbox enablement | Whether managed sandboxing is active | Confirm the policy reaches a managed workstation |
| Filesystem access | Files and directories visible or writable to the agent | Try reading a denied path and writing outside the project |
| Network access | Outbound destinations available to agent tools | Attempt an allowed host and a denied host |
| Proxy settings | How approved traffic leaves the device | Verify logs and block direct bypass |
| Developer tools | Local tools the agent can invoke | Test approved and disallowed executables |
| macOS Keychain | Whether secrets stored in Keychain can be reached | Confirm a protected credential remains inaccessible |
Managed restrictions override local settings
GitHub says the organization-managed restrictions take precedence over user settings. An administrator can therefore apply a narrower filesystem or network boundary than a developer would choose locally.
Do not assume precedence without testing it. Put one workstation in a pilot policy, set a known denied path and host, then attempt both from the agent. Record the policy version, IDE plugin version, user-visible setting, agent response, and operating-system logs.
The new /ide connection expands context
A Copilot CLI session can use /ide to connect with JetBrains context. GitHub lists selections, diagnostics, file references, terminal environment, and the configured Python interpreter among the shared context. The update also supports cross-file cursor jumps and global project context.
This can make the CLI more useful because it no longer has to reconstruct the editor state from scratch. It also means administrators should model the combined boundary. A restricted CLI session may inherit useful information or capabilities from the IDE connection.
Map every context bridge before rollout
- Selected code can contain secrets or sensitive business logic.
- Diagnostics can reveal paths, package names, and build details.
- File references can lead the agent to material outside the active editor tab.
- The terminal environment can expose variables and tool configuration.
- A Python interpreter can carry packages, credentials, or access inherited from its environment.
- Global project context can enlarge the data available to a narrow task.
The goal is not to remove useful context. It is to know which bridge supplies it and which policy governs the downstream action.
Public preview changes the deployment decision
GitHub labels enterprise-managed sandbox policies and the CLI-to-IDE connection as public preview. OpenTelemetry settings are generally available. Preview status can mean changing behavior, incomplete platform parity, or limited support commitments.
Use a pilot group before applying the preview to a broad developer fleet. Keep the existing controls around credentials, repositories, endpoints, and code review. A preview sandbox should strengthen those controls, not replace them.
Observability is available, but define the questions first
The update marks OpenTelemetry settings as generally available. Telemetry is most useful when administrators decide what they need to detect: denied access, repeated permission prompts, unusual network destinations, high tool-call volume, long tasks, or policy bypass attempts.
Collect the minimum useful data, define retention, restrict access to traces, and prevent source code or secrets from being copied into observability systems unintentionally. Our Copilot policy checklist explains why retention and billing settings belong in the same administrative review.
A controlled JetBrains pilot
- Choose a non-production repository: include realistic dependencies without production credentials.
- Set explicit deny rules: block one path, one host, one tool, and Keychain access.
- Connect the CLI with /ide: inspect the context shared from selections, diagnostics, files, terminal, and Python.
- Test policy precedence: make the local setting permissive and confirm the managed restriction still wins.
- Review telemetry: verify that denied actions are visible without leaking sensitive code.
- Document rollback: know how to disable the preview and return to the earlier workflow.
Teams evaluating multiple coding agents can use our Codex versus Claude Code guide to compare model, harness, permissions, and operational controls separately. Our earlier report on Copilot Memory in JetBrains also covers what can persist between sessions.
My verdict: test the override, not just the settings page
The enterprise sandbox is a useful step because it gives administrators enforceable controls over a local agent workflow. The CLI-to-IDE bridge can also reduce friction for developers who already work in JetBrains.
The release is not finished infrastructure yet. Preview status, context sharing, and local environment inheritance make hands-on validation essential. A policy is successful when the denied action fails on the workstation and the evidence appears in the right logs.
Read the primary source
- Read GitHub’s Copilot for JetBrains enterprise sandbox announcement.
Checked September 9, 2026. Feature, control, and availability statements are GitHub-reported. Policy tests and rollout guidance are Musthave.ai analysis.
