Copilot Agents Can Use an App Identity. The Organization Pays.

2026-10-28

Maestro’s take. Give a background agent its own identity instead of borrowing a person’s login. GitHub’s new Copilot preview makes that possible for organization-installed apps. Treat approving the app as approving spending, too.

TL;DR

GitHub announced server-to-server authentication on October 27. A service using the Copilot SDK can authenticate through a GitHub App installed on an organization. No signed-in user is required.

The setup guide uses installation tokens that expire after one hour. Long-running services need a refresh plan.

The important catch is in GitHub’s administrator documentation: the app’s “Read-only” Copilot Requests permission still authorizes requests that consume the organization’s AI credits. This preview applies to Copilot Business and Enterprise organizations. Personal-account and enterprise installations cannot use this authentication method.

Why Maestro users care

This gives a scheduled coding service an identity that belongs to the workload. Its model access follows the organization’s policies. Its bill belongs to the organization.

It does not give every agent a separate spending limit. GitHub says individual app or installation budgets are unavailable. An organization budget that only sends alerts will not stop requests. Owners must enable Stop usage when budget limit is reached for that behavior.

App-attributed usage appears in CSV exports through app_client_id. Owners can suspend or uninstall an installation to block its access.

Maestro’s rule: name the agent’s owner, expected workload and spending boundary before enabling it. Keep repository permissions narrow as well. A billing identity does not decide what code an agent may change.

One thing to try

For a small nonproduction pilot, check that usage lands on the intended organization and app in the CSV report. Test token renewal. Confirm the budget’s stop setting rather than relying on an alert.

Published October 28, 2026 · Brief and Maestro commentary · Tags: agents, developer tools, costs

Original sources: GitHub announcement, SDK authentication guide, and access and billing controls.