A team wants to rely on custom instructions for a security rule. Why is that not enough on its own?
Why D is the answer
Copilot may not always follow instructions the same way every time
GitHub says so directly. Enforce must-have rules with tools such as branch protection, CI and code scanning.
In detail
- Instructions guide Copilot, but they do not guarantee behavior.
- A security rule needs enforcement elsewhere, such as code scanning or review.
- Use CI, branch protection and code scanning for rules that must hold.
Use case
An illustrative scenario, not a real incident.
A team writes "never log tokens" in its instructions, and a token still ends up in a log. A CI check catches it, because instructions only guide Copilot.
See it in different ways
mindmap
root((Instructions))
Repository wide
copilot-instructions.md
One path
NAME.instructions.md
Agents
Nearest AGENTS.md
Chosen by hand
Prompt filesflowchart TD
Q{"What if it is broken?"}
Q -->|"A style preference"| A0["Custom instructions"]
Q -->|"A security rule"| A1["CI and branch protection"]Key point: Instructions guide, and tools enforce.
Why the other options are wrong
- A. Instructions are only read by Copilot on the first day that they are added
- Instructions are read on later requests too.
- B. Instructions can only be written in English and cannot mention any security
- They are not limited to English, and can mention security.
- C. Instructions are only available to enterprise owners and not to developers
- Developers can use them.