Copilot CLI: Permissions, Config, Trusted Folders, and Environment Variables/Deny a dangerous shell action
Block a specific command even when a broader rule allows related commands.
Section: Permissions, tools, paths, and URLs
Deny a dangerous shell action
bash
bash
copilot --allow-tool="shell(git:*)" --deny-tool="shell(git push)"Explanation
Deny rules take precedence over allow rules, which is ideal for guardrails.
Learn the surrounding workflow
Compare similar commands or jump into common fixes when this command is part of a bigger troubleshooting path.
Related commands
Same sheet · prioritizing Permissions, tools, paths, and URLs
Allow all tools, paths, and URLs
Disable approval prompts for the whole run.
Block a specific URL or domain
Prevent access to sites you do not want queried.