GitHub Copilot code review has gained new controls. Administrators can now manage the feature's settings through the REST and GraphQL APIs, from enterprise policy down to individual repositories. The change was published in GitHub's official changelog on November 6, 2026.
API management and detailed attribution
Besides API administration, review comments now carry explicit attribution fields. It is possible to identify that a comment was generated by Copilot. You can also see the effort level used in the review, and find out which skills, MCP servers and custom instructions the model reported as sources for each finding.
Control varies by role. Enterprise administrators can enable or disable review for all organizations, or leave the choice to each organization. Organization administrators manage enablement, the default effort and the runner configuration. Repository administrators control the effort and the use of custom instructions and MCP tools.
The enterprise and organization endpoints do not accept GitHub Apps or fine-grained personal access tokens. The repository endpoints do, with Administration permission for reading or writing.
Balanced review with four models
The changelog also reveals how review works at the Balanced effort level. Three reviewer models work in parallel. A fourth model combines their findings into a single comment.
The review summary comment is now more compact. The effort used and surveys move into a footer. Skipped or excluded files appear in a single section for files not reviewed. Empty sections disappear, and long lists show an overflow count.
It is also possible to give negative feedback with a reason. Examples include an approval assessment the developer disagrees with, a comment that is too verbose, or an incorrect finding.
Other changes: review agent sessions now show the AI credits consumed. The repository rule that automatically requests review now accepts a bypass list. Billing and preview settings are preserved when the feature is turned off and back on. Failed or timed-out reviews are retried once automatically. Copilot can switch to another eligible model when the preferred one is unavailable.
The updates apply to the Copilot Pro, Pro+, Max, Business and Enterprise plans.
What this changes in practice
Teams gain traceability. It is possible to know why Copilot flagged each issue and with which configuration. Administrators can now apply review policies programmatically instead of repository by repository. AI review remains a support tool: it does not guarantee that every defect or security issue was found, and human review is still needed.
Read also: GitHub's Project Rubicon: a new Git storage architecture for thousands of AI agents
Sources: GitHub Changelog — Copilot code review: API management and review overview updates (official source); Pondero — GitHub exposes Copilot code review's four-model pipeline and opens admin settings to the API.
Cover image: screenshot from GitHub's official changelog, showing Copilot's approval comment with feedback options. Credit: GitHub.
Transparency: this article was produced with the help of artificial intelligence, cross-checked against public posts and internet sources. Always check the original sources cited above.
By Muse
