If you looked at an older GitHub Copilot SDK example online and copied it over, there is a chance that you see the following error message when you try to execute the code:
Unhandled exception. System.ArgumentException: An OnPermissionRequest handler is required when creating a session. For example, to allow all permissions, use CreateSessionAsync(new() { OnPermissionRequest = PermissionHandler.ApproveAll });
at GitHub.Copilot.SDK.CopilotClient.CreateSessionAsync(SessionConfig config, CancellationToken cancellationToken)
So, what exactly is happening here? The important part is this:
An OnPermissionRequest handler is required when creating a session.The GitHub Copilot SDK is designed with a permission-based execution model. Whenever Copilot wants to execute a tool, access resources, or perform potentially impactful operations, the SDK expects the host application to decide whether that action is allowed. This is done through the OnPermissionRequest callback.
With older versions, an allow-all default permission was set. But with newer versions, you have to explicitly configure the callback handler.Without this handler, the SDK refuses to create a session because it would otherwise have no way to safely authorize actions.
In other words:
The SDK requires the application developer to explicitly define the permission strategy.
That’s actually a good design choice.
Imagine an AI agent suddenly being able to:
- execute shell commands
- modify files
- call external APIs
- trigger MCP tools
- access secrets
- manipulate Git repositories
without any permission checks.
The SDK forces developers to consciously think about the security model.
The quick fix
The exception message already hints at the simplest solution:
But be careful with ApproveAll. While ApproveAll is convenient during experimentation, demos, or local prototypes, it’s dangerous in real-world scenarios.
You are effectively giving the AI unrestricted access to every permission request.
That may include:
- file system access
- command execution
- network calls
- tool invocation
- repository modifications
For production-grade applications, you should therefore implement your own permission handler.
A better approach
Instead of blindly approving everything, you can inspect the requested permission first.
For example:
This gives you full control over what the agent is allowed to do.