GitHub Copilot observability exposes the governance gap in agentic AI

At a glance

What this is: This is an analysis of GitHub Copilot telemetry observability and the key finding that agentic coding tools need runtime visibility into prompts, tool calls, and sensitive-data exposure.

Why it matters: It matters because IAM, security, and AI governance teams need auditable control over how developer-facing agents interact with code, credentials, and internal data.

By the numbers:

• 38% of secrets incidents in collaboration and project management tools like Slack, Jira, and Confluence are classified as highly critical or urgent.
• 17 minutes.

👉 Read Fiddler's analysis of GitHub Copilot observability and AI governance

Context

GitHub Copilot has moved from a simple autocomplete experience to an agentic system that can plan tasks, call tools, read and write files, and execute commands. That shift creates an identity and governance gap because the session now behaves more like a delegated actor than a passive editor, yet many enterprises still manage it as if license count were enough.

The operational issue is not just productivity. Once prompts, responses, repository context, and tool calls become part of everyday development flow, security teams need visibility into where sensitive data may be introduced, echoed, or acted on. For AI governance, that makes Copilot telemetry part of the control plane rather than an optional analytics feed.

This is a familiar pattern in broader identity security: once an automated system can act with meaningful privileges, the control problem shifts from access provisioning to runtime oversight. The starting position described in the article is increasingly typical in large enterprises, which is why it deserves scrutiny.

Key questions

Q: How should security teams govern AI coding assistants that can execute commands?

A: Treat them as delegated non-human identities with bounded execution authority. Require human approval for destructive commands, keep command scopes narrow, and log every tool action. The key control question is not whether the assistant is helpful, but whether it can be prevented from acting outside intended scope when prompts, context, or rules are manipulated.

Q: Why do AI assistants create a new trust problem for identity governance?

A: AI assistants create a new trust problem because they can read data, choose tools, and act on external text in ways traditional review processes do not expect. Identity governance has to account for action promotion, provenance, and egress, not only authentication or entitlement assignment.

Q: What breaks when teams rely on seat counts instead of agent telemetry?

A: Seat counts show adoption, not behaviour. They cannot tell you which repository was touched, whether a prompt contained secrets, or whether the agent made a high-risk tool call. Without telemetry, you lose the evidence needed for incident response, compliance review, and cost accountability.

Q: How can organisations reduce data exposure in AI tools?

A: Start with data classification, then map where sensitive information can flow into prompts, connectors, and logs. Limit AI systems to the minimum data they need, require owner approval for higher-risk datasets, and monitor for unsanctioned sharing. Data controls work best when paired with identity controls and usage visibility.

Technical breakdown

Why Copilot telemetry is an identity and governance signal

OpenTelemetry gives AI tools a common event format for recording prompts, responses, tool calls, token counts, model invocations, and session context. That matters because agentic systems do not just generate text, they interact with codebases and operational systems in ways that create audit and policy obligations. When telemetry is standardized, security teams can correlate behaviour across sessions instead of relying on isolated logs or developer self-reporting. The important shift is from usage visibility to decision visibility, which is where AI governance becomes enforceable rather than theoretical.

Practical implication: treat agent telemetry as a governed control surface, not a convenience metric.

What semantic mapping solves in mixed agent environments

Different agentic tools often emit different attribute names, which makes ingestion and policy evaluation brittle. Semantic mapping normalizes those variations so traces from Copilot, coding assistants, and gateway layers can be interpreted consistently. In practice, this is an interoperability problem disguised as an observability problem. Without normalization, teams end up with partial pictures, broken dashboards, and inconsistent policy enforcement across tools that should be governed together.

Practical implication: standardize trace fields before trying to compare agent behaviour across platforms.

Why secrets detection belongs in the runtime layer

Secret and credential exposure is not just a repository hygiene issue. Once a developer pastes a key into a prompt, or an agent echoes sensitive data in a response, the exposure has already crossed into runtime behaviour and may be persisted in logs or traces. That is why detection at the session layer matters. The control need is close to DLP, but with AI-specific context such as prompts, tool chains, and model outputs. For governance, runtime detection closes the gap between policy intent and actual agent behaviour.

Practical implication: monitor prompts and outputs for secrets and credentials before they become durable records.

NHI Mgmt Group analysis

Copilot telemetry is becoming part of the identity layer for AI systems. Once an assistant can call tools, touch repositories, and execute tasks, the governance question is no longer only about model quality. It becomes about who or what acted, under which context, and with what authority. That is why AI observability now intersects directly with identity governance and NHI-style control thinking.

Runtime visibility is the missing control in most agentic AI deployments. Enterprises often know how many licenses they bought, but not what the system actually did after a prompt was issued. That leaves gaps in accountability, evidence collection, and incident triage. The named concept here is control-plane observability debt: the accumulation of agent activity that cannot be reconstructed well enough for audit, investigation, or policy enforcement. Practitioners should treat that debt as an emerging governance exposure.

Standardized telemetry reduces fragmentation, but it does not create policy by itself. OpenTelemetry can unify trace collection across coding agents and gateways, yet teams still need clear rules for what is allowed, what is logged, and what triggers intervention. Without those rules, observability becomes a reporting layer rather than a control layer. The practical conclusion is to pair telemetry normalization with explicit enforcement boundaries.

Secrets and PII detection at the session layer changes the security model for development tools. Developer prompts can now carry credentials, customer data, and internal code context into places that were never designed for durable sensitive information. That makes the agent session part of the sensitive-data lifecycle. Security teams should re-evaluate how they classify developer workflows when AI tools can both access and reproduce protected material.

This market is converging around agent governance rather than isolated point integrations. The article reflects a wider shift from managing one assistant at a time to governing multiple agentic systems through a common operational model. For IAM and AI security teams, that means future tooling decisions should be measured against auditability, interoperability, and policy enforcement, not just dashboard coverage.

What this signals

Control-plane observability debt: as coding agents spread, organisations will need a defensible way to reconstruct who did what, with which model, against which repository, and under what policy. NIST SP 800-53 Rev 5 Security and Privacy Controls remains relevant because auditability, access control, and monitoring are now inseparable from AI operations.

The practical signal for security teams is that telemetry alone will not reduce risk unless it is joined to access boundaries and sensitive-data controls. That means defining review thresholds for prompts, tool calls, and repository access, then proving those thresholds are enforced consistently across teams and tools.

Identity and AI governance will increasingly overlap as assistants behave like delegated actors rather than passive utilities. The programme-level implication is that IAM, AI security, and engineering leadership need shared policy language for sessions, evidence, and escalation before agent sprawl turns into governance sprawl.

For practitioners

• Define Copilot as a governed runtime surface Classify coding-agent sessions as security-relevant activity, then decide what must be logged, retained, reviewed, and escalated before rollout expands across more developer seats.
• Normalize telemetry before adding policy rules Map prompts, tool calls, repository context, and model identifiers into a consistent schema so policy engines and analysts can compare behaviour across assistants and gateways.
• Add secrets and PII detection to session monitoring Scan prompts, responses, and tool outputs for credentials, customer data, and other sensitive content so leakage is caught while it is still inside the agent workflow.
• Separate usage reporting from control enforcement Track token spend, latency, and productivity metrics, but pair them with hard controls for prohibited data types and high-risk tool actions to avoid treating analytics as governance.
• Review identity assumptions for agentic tools Reassess whether existing access, audit, and offboarding processes are sufficient when a coding assistant can execute actions that previously required direct human intervention.

Key takeaways

• Copilot observability is now a governance issue, not just an engineering convenience, because agent sessions can touch code, tools, and sensitive data.
• GitHub repositories remain exposed to secret leakage at a measurable scale, so runtime detection and auditability matter as much as prompt quality.
• Teams need telemetry plus policy boundaries if they want to govern agentic AI in a way that stands up to security, audit, and operational review.

Key terms

• Observability For Agentic AI: The ability to reconstruct what an AI agent accessed, which tools it used, and what outputs it produced during a session. This is more than logging prompts. It provides the evidence needed for security review, incident investigation, and compliance validation.
• Control-Plane Observability Debt: The accumulation of AI or automation activity that is too poorly instrumented to reconstruct after the fact. When sessions, tool calls, and data access are not logged consistently, security teams lose evidence for investigation, policy enforcement, and accountability even when the system is otherwise working normally.
• Semantic Mapping: Semantic mapping connects technical metadata to business meaning so users and systems interpret a data asset consistently. It reduces ambiguity across teams by aligning terms, definitions and relationships, which is essential when the same dataset supports reporting, analytics and AI use cases.
• Runtime Sensitive-Data Detection: Detection of secrets, credentials, personal data, or other protected content while a session is active rather than after storage or exfiltration. This is especially important for AI tools because prompts and outputs can become durable records long before a conventional review process notices the exposure.

What's in the full article

Fiddler's full blog covers the operational detail this post intentionally leaves for the source:

• Exact environment-variable setup for streaming Copilot OpenTelemetry into Fiddler
• Attribute-level filtering examples for token usage, model names, and repository context
• Semantic mapping guidance for normalizing non-standard OpenTelemetry fields across agent tools
• Dashboard views for response quality, frustration signals, and git activity volume

👉 The full Fiddler post covers setup steps, semantic mapping, and session-level metrics in detail.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, IAM, and secrets management. It helps practitioners translate identity controls into operational policy across modern AI and automation programmes.