Enforce Copilot CLI guardrails from MDM before agent settings drift

GitHub's managed Copilot settings are now useful for endpoint-level governance, not just account-side policy. Enterprise admins can push the same settings into VS Code and Copilot CLI through native MDM, server-managed settings, or a root-owned local managed-settings.json file.

Use this when agent policies need to follow the machine, not just the signed-in user. The practical checks are simple: decide which settings must be non-bypassable, choose the delivery channel that matches your fleet, test precedence, and confirm developers cannot override the managed tier locally.

This is a resource, not a hands-on review. Treat it as a deployment checklist for Copilot governance across managed developer machines.