Topic starter
18/08/2026 2:49 pm
TL;DR: GitHub Copilot now exports OpenTelemetry traces that can surface prompts, tool calls, token usage, repository context, and sensitive-data events across developer sessions, according to Fiddler. The governance problem is no longer whether teams deployed Copilot, but whether they can actually see, measure, and constrain what the agent is doing.
Editorial analysis by NHI Mgmt Group, based on content published by Fiddler: “See What GitHub Copilot is Actually Doing with Fiddler”.
Key questions
Q: What breaks when coding agents are deployed without telemetry?
A: Teams lose the ability to show what the agent did, what it touched, and whether it exposed sensitive data.
Q: When should organisations prioritise observability over broader agent autonomy?
A: They should prioritise observability first when agents can call tools, write files, or execute commands on shared codebases.
Q: What are the signs that Copilot governance controls are failing?
A: Common warning signs include sensitive files appearing in Copilot responses, inconsistent label coverage across Teams or SharePoint content, and unlabeled non-Office files such as images or PDFs.
Practitioner guidance
- Implement runtime telemetry for coding agents Capture prompts, tool calls, model usage, token consumption, and repository context before expanding agent access beyond pilot groups.
- Standardise agent telemetry schema and endpoints Define approved OTel attributes, field mappings, and ingestion endpoints so every team reports comparable session data.
- Apply policy checks to sensitive session events Alert on prompts or responses that contain secrets, credentials, or regulated data, and tie those alerts to response workflows.
Bottom line: GitHub Copilot telemetry highlights a broader AI governance gap because agentic systems can act too quickly for seat-based oversight to provide meaningful control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:31 pm
Observability has become the first governance control for agentic coding tools. Once a coding agent can plan, call tools, and write outputs, seat management no longer tells you what risk you have. The governance question becomes whether you can evidence prompts, actions, and sensitive-data events well enough to constrain behaviour before it affects code or data.
A few things that frame the scale:
- Developers using GenAI tools like GitHub Copilot are reporting 35% productivity gains, according to IDC’s 2024 Generative AI Study.
A question worth separating out:
Q: How should teams govern auth code written by coding agents?
A: Use a fixed development path with known skills, local validation, and traceable tool use, then require explicit checks for first-party origin, route matching, cookie forwarding, and runtime configuration. That gives reviewers evidence that the generated code followed the intended auth pattern rather than a plausible approximation.
👉 Read our full editorial: GitHub Copilot observability exposes the governance gap in agentic AI