GitHub Copilot's Global Model Policy Is Live: Governing the AI Model Zoo Before It Governs You

Between late August and early September 2026, GitHub changed the default rules of enterprise Copilot governance in one stroke. It began enforcing the org-level Global Model Policy, under which models an administrator never explicitly configured inherit the org-wide default, and open-weight models such as DeepSeek and Kimi K2 stay off unless an admin turns them on. Then, on September 1, it reopened Copilot Business and Enterprise signups for credit-card and PayPal customers and moved the code review default to a Balanced effort level; on September 4, GPT-6 Astra became generally available inside Copilot. The real message for administrators: when new models ship weekly or faster, the default is your governance. Manage defaults poorly and the model zoo will govern you. This guide breaks down the policy details and your action list.

1. What the Global Model Policy Actually Enforces

GitHub's Global Model Policy is an org-level setting that began enforcement in late August 2026, and GA models released after September 1 automatically inherit it. The core mechanism is inheritance plus explicit overrides: models an admin never touched behave according to the org default; models an admin explicitly configured follow that explicit config. The most compliance-relevant piece is how open-weight models are handled: DeepSeek, Kimi K2, and similar models are off by default and require an administrator to switch them on, closing the old gap where a newly added model was effectively invisible yet usable. GitHub also moved the Copilot code review default to Balanced and let enterprise-managed settings support any default model.

# Governance default: unconfigured models inherit the org policy.
# DeepSeek and Kimi K2 stay OFF unless an admin explicitly enables them.
policy = {
    "version": "2026-09",
    "default": "inherit",          # new models follow org default
    "org_default_model": "gpt-6-astra",
    "open_weight_models": {
        "deepseek": "off",
        "kimi-k2": "off",
    },
    "code_review_effort": "balanced",
}
print(policy["default"])

2. Why Default-Driven Governance Is a 2026 Necessity

Model supply in 2026 has reached a weekly-release cadence: GPT-6 Astra, Claude Fable 5.1, Gemini 3.8 Flash, and the GLM-5.3 family all landed within weeks of each other. Under the old model, a new model appearing on the roster was effectively invisible until an administrator configured it, meaning employees could already be using a fresh model on tasks involving sensitive code while security and compliance had no idea. The Global Model Policy flips governance from chasing new models to default-inherit plus allowlist exceptions: safe by default, open only by explicit action. This is the classic deny-by-default pattern, applied systematically to AI coding tools for the first time.

# Audit which Copilot models are actually enabled in your org.
def audit_enabled_models(org_settings):
    enabled = []
    for model, cfg in org_settings["models"].items():
        if cfg.get("enabled", False):
            enabled.append(model)
    return enabled

settings = {
    "models": {
        "gpt-6-astra": {"enabled": True},
        "claude-sonnet-5": {"enabled": True},
        "deepseek-v4": {"enabled": False},   # off by default
    }
}
print(audit_enabled_models(settings))

3. Subscription and Billing Policy Are Changing Too

On September 1, GitHub reopened Copilot Business and Enterprise signups for credit-card and PayPal customers. Those subscriptions had been restricted for months, and the official explanation frames the change around availability and reliability: GitHub strengthened account vetting and updated the billing experience. The same day, the Copilot code review default moved to a Balanced effort level. For enterprises, reopened signups mean the procurement path is back, but stricter account vetting means register-first-and-fill-in-details-later may no longer work. GitHub also gave an explicit deadline: administrators should review the policy before September 28 and confirm it reflects how they want to manage Copilot access for their teams.

# A model policy must answer three questions per model.
def policy_for_model(model):
    return {
        "model": model,
        "allowed_teams": ["platform", "backend"],
        "data_use": "no_training",        # keep enterprise IP out of training
        "review_effort": "balanced",      # GitHub's new default
        "budget_cap_usd_per_user": 50.0,
    }

print(policy_for_model("gpt-6-astra"))

4. Cost Governance for the New Model Era: User-Level Budgets

More models, and stronger models, make cost governance more critical. GitHub's enterprise-managed settings now support expiration dates on individual user budgets, which pairs with model-level policy for fine-grained control: which teams can use which model, what the monthly cap per user is, and whether overage triggers a warning or a suspension. The recommended approach for admins is to model in three dimensions, model by team by budget: platform and backend teams can default to a new flagship such as GPT-6 Astra, while peripheral teams keep using cost-efficient models; give every user a monthly cap so AI coding cost shifts from end-of-month shock to beginning-of-month budget. And treat those configurations as code, versioned and reviewed, or every org change becomes a click-fest in the console.

5. Admin Action List: Five Things Before September 28

GitHub tells administrators to review the policy before September 28; work through this order. First, open enterprise settings, confirm the Global Model Policy is enabled, and pick your org default model. Second, audit the open-weight model list explicitly; off by default does not mean permanently off, so confirm DeepSeek, Kimi K2, and similar models were not switched on by a team without you noticing. Third, align the code review default, now Balanced, with your team workflow so the change does not cause a PR experience shock. Fourth, set budget caps and expiration dates per user or per group. Fifth, record policy changes in your audit log and tell every administrator about the new defaults, because from now on, not configuring is itself a configuration.

# Simulate what happens when a new GA model ships after Sept 1.
# Under the old system it was invisible; under the policy it inherits.
def new_model_status(global_policy, model_name):
    if model_name in global_policy.get("explicit_overrides", {}):
        return global_policy["explicit_overrides"][model_name]
    return global_policy["default"]       # "inherit" -> org default

policy = {"default": "inherit", "explicit_overrides": {}}
print(new_model_status(policy, "future-model-2027"))  # inherit

6. Governance Is Not a One-Time Setting, It Is a Pipeline

The greatest value of the Global Model Policy is not any single switch; it is turning model governance from a one-time setting into a continuous pipeline: new models inherit the default automatically, enabling requires an explicit action, budgets have caps and expiration dates, and code review has a default effort level. The lesson for platforms is to copy this mindset across all of your AI tooling: any newly integrated model, agent, or MCP server should be deny-by-default and allow-by-explicit-action. Write policies as code, verify API calls with an API tester, validate payloads with a JSON formatter, and protect tokens with an env-file validator; the tooling that governs models is no different from the tooling that governs any other infrastructure. The model zoo will only get bigger. Your job is to make sure every new animal walks through the same quarantine before it enters the park.

# Enforce an expiration date on individual user budgets.
def enforce_budget(user, monthly_cap=50.0):
    spent = user["spent_this_month"]
    if spent > monthly_cap:
        return {"action": "suspend_agent_access", "reason": "budget_exceeded"}
    return {"action": "allow", "remaining": monthly_cap - spent}

print(enforce_budget({"spent_this_month": 61.0}))