A policy request can succeed while the intended user still lacks a model. Keep the configuration response and the observed access in the same change record.
Four endpoints expose model policy controls
GitHub’s October 19 announcement makes GET and PATCH model-policy endpoints generally available at enterprise, enterprise-team, enterprise-app, and organization levels.
The APIs expose model availability controls that administrators can manage programmatically. They do not replace the need to understand which level controls the target account.
Delegation changes which policy matters
GitHub distinguishes organization mode from enterprise teams mode. In the former, an enterprise can delegate model control to organizations; in the latter, to teams and apps.
The enterprise AI-controls REST reference documents endpoint requirements. Check the specific endpoint, authorization, and delegation mode before preparing a write. This article makes no authenticated policy requests.
Build a reversible policy change
Start by exporting the current policy at the controlling level. Identify one eligible model and a small test audience. Write down the expected result before sending an update.
- Save the original policy and the target account identifiers.
- Confirm which enterprise mode and delegated level apply.
- Use credentials authorized for the specific endpoint.
- Apply only the intended model-policy change.
- Read the policy back and compare it with the request.
- Check availability from an account in the intended audience.
- Restore the saved value if the observed access differs.
Keep a denied account in the test as well. A broad change that makes the model available everywhere can satisfy the positive test while missing the permission boundary.
Use retirement notices to review the destination model
Policy automation helps during model retirement, but the migration still needs a supported destination. Retiring a model and enabling its replacement are separate events.
I would connect each policy change to a small set of accepted repository tasks. A model appearing in the picker establishes availability, not equivalent behavior or the same cost per completed task.
The updated Copilot retirement guide lists the October 19 replacements. Our HydraFusion workflow guide discusses routing and whole-task evaluation.
Read the sources and plan your next step
Which account will you use to verify the effective policy after the API returns success?
Checked October 20, 2026. This is source-based reporting and analysis; proposed checks are not hands-on test results.
