Agentic workflows no longer need a personal access token

June 11, 2026 — GitHub Agentic Workflows can now use GitHub Actions’ built-in GITHUB_TOKEN instead of personal access tokens (PATs), eliminating operational and security risks of managing long-lived PATs at scale.

Requirements

1. Enable “Allow use of Copilot CLI billed to the organization” Copilot policy (enabled by default if existing Copilot CLI policy is on)
2. Add copilot-requests: write to the permissions section in agentic workflow markdown frontmatter
3. Compile and push updated lockfile
4. Upgrade CLI: gh extension upgrade aw

Availability

All Copilot plans: Copilot Free, Pro, Pro+, Business, and Copilot Enterprise.

Context

Part of GitHub Agentic Workflows public preview announced the same day. PAT-based authentication remains available as fallback for cross-repo, Projects v2, or CI trigger scenarios requiring elevated scopes.