GitHub lets administrators require fresh remote policy at startup with forceRemoteSettingsRefresh=true. If a client cannot confirm policy, it fails closed instead of using a cache. It covers the CLI, VS Code and Copilot app. MDM or file delivery can enforce freshness before first sign-in; a server-delivered value applies on subsequent startups after receipt.
October 13 also adds minimum-client-version enforcement for sandbox. On October 12, GitHub separated identity capture from five content classes in OTel telemetry. All are off by default; explicit managed policies can override local settings.
Fail-closed is an option, not the universal unconfigured behavior. Enabled traces may contain code, paths and tool outputs: auditability is not harmlessness.
Control moves outside the model into enforced runtime policies. Test policy-server outages, outdated clients and collection minimization.