The report
An agent action that runs once in a chat and one that keeps running after its creator leaves are different authorization designs. GitHub's October 28 announcement says shared Copilot Automations belong to a repository, can be edited by users with repository write access, are billed to its owner and execute as Copilot. They continue operating after the person who created them departs.
GitHub says organizations need an administrator policy to enable cloud-agent billing, and users can inspect changes to automation prompts, tools and triggers. The existence of these controls does not independently prove that all old permissions are revoked at the correct time. When repository ownership or access changes, administrators need a separate inventory and revocation process for durable automations, their connectors and their credentials.
The existing DeepSeek mandate prototype offers a useful contrast: both introduce work that outlives the initiating turn, but their principals, admission controls and execution environments differ. The shared cross-session authorization question is whether a once-approved workflow remains entitled to make the exact side effect when the org's policies and people change.
Persistence creates a new review boundary
Repository write access can be sufficient to modify a shared automation's prompt, triggers or tools, while the resulting execution is attributed to the Copilot automation rather than the original human author. Consequently, an employee's departure cannot be treated as automatic revocation of any persistent connector grants or operational intent attached to the repository. The useful comparison with DeepSeek's mandate prototype is not that the two products share a security flaw; it is that their stored instructions must be reevaluated when team ownership, access policy, or external side effects change. The launch announcement describes governance features, not an independent audit of expiration and revocation in every deployment.
The principal changes, not just the billing owner
GitHub says shared automations run as Copilot, are editable by repository writers, and preserve a change history for prompts, triggers and tools. The identity executing an action is thus not the creator's identity, even if a human first defined the automation. A governance review has to tie the currently permitted tools to a repository's present purpose and maintainers. It should also test what happens to external connector permissions after a maintainer loses access, because GitHub's announcement does not demonstrate revocation at those third-party services. This is not an incident claim. It is a documented deployment model that raises the same cross-session authorization question as the DeepSeek durable-mandate prototype under different ownership rules.