docs: document automatic minimum-integrity-approved guard policy for public repos

[Copilot]

Public repositories using GitHub MCP without explicit lockdown or min-integrity configuration now automatically receive min-integrity: approved at runtime — but this behavior was undocumented.

Changes

• reference/lockdown-mode.md: Added "Automatic Minimum-Integrity Protection" section covering the new default, which repos it applies to, exclusions (explicit config, GitHub App token), and how to opt out.

• reference/github-tools.md: Added callout in the Guard Policies section noting the automatic behavior for public repos with a link to the new section.

• reference/faq.md: Extended the lockdown FAQ answer to distinguish between traditional lockdown mode (requires custom token) and the new automatic min-integrity: approved (no additional auth needed).

Key behavior documented

Repository visibility	Explicit config?	Applied guard policy
Public	No	min-integrity: approved (automatic)
Public	Yes	Explicit value (no override)
Private/Internal	No	min-integrity: none
Any	GitHub App token	No automatic policy

To disable the automatic guard policy on a public repo workflow that intentionally processes all user input:

tools:
  github:
    min-integrity: none

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• telemetry.astro.build
  • Triggering command: /opt/hostedtoolcache/node/24.14.0/x64/bin/node node /home/REDACTED/work/gh-aw/gh-aw/docs/node_modules/.bin/astro build (dns block)
  • Triggering command: /opt/hostedtoolcache/node/24.14.0/x64/bin/node node /home/REDACTED/work/gh-aw/gh-aw/docs/node_modules/.bin/astro build tion instructio (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Update the automatic lockdown documentation to describe the new behavior:

For public repositories where the GitHub MCP server is not configured with lockdown or minimum-integrity, we automatically apply minimum-integrity-approved so that the guardrail is installed.

Custom agent used: technical-doc-writer
AI technical documentation writer for GitHub Actions library using GitHub Docs voice

---

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.

[Copilot]

Pull request overview

Documents the new runtime default guard behavior where public repositories using the GitHub MCP server receive an automatic min-integrity: approved policy when no explicit lockdown/min-integrity is configured.

Changes:

• Added an “Automatic Minimum-Integrity Protection” section explaining when min-integrity: approved is auto-applied and how to override it.
• Added a guard policy callout in the GitHub tools reference linking to the new lockdown-mode documentation.
• Updated the lockdown-mode FAQ to distinguish automatic min-integrity: approved behavior from traditional lockdown mode behavior.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
docs/src/content/docs/reference/lockdown-mode.md	Adds primary documentation for the automatic min-integrity: approved default and opt-out guidance.
docs/src/content/docs/reference/github-tools.md	Adds a guard policy note pointing readers to the new automatic behavior documentation.
docs/src/content/docs/reference/faq.md	Extends the FAQ answer to mention the new automatic min-integrity: approved behavior.
docs/src/content/docs/agent-factory-status.mdx	Updates the agent factory workflow list (Smoke Agent entries and removal of a removed workflow).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.