From f57ed0c3b5c321f3997d5af0ca8194ae1aeb648f Mon Sep 17 00:00:00 2001 From: Damyan Pepper Date: Mon, 17 Aug 2026 13:01:22 -0700 Subject: [PATCH 1/2] Require attribution for content posted on a user's behalf Agents acting through a user's GitHub account can open pull requests, write descriptions, and reply in review threads that appear, to any reader, to have been written by that user. Commits already carry a Co-authored-by trailer, but content posted through the API does not, so authorship is misrepresented by default. Add a section to the repository instructions requiring an "_Assisted by GitHub Copilot._" trailer on pull request descriptions, issue bodies, review comments and replies, pull request and issue comments, and discussion posts. Bots that post under their own identity, such as copilot-pull-request-reviewer[bot], are already attributed and are explicitly out of scope. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e8b5337d-516d-45c2-aa9d-2efb79ebaf86 --- .github/copilot-instructions.md | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md index ff7a758d2d..34928c6760 100644 --- a/.github/copilot-instructions.md +++ b/.github/copilot-instructions.md @@ -31,3 +31,29 @@ Comment tone: - Use a stronger ask when the PR clearly appears to be a user-visible bug fix or feature. - If release-note coverage may come in a related PR (including a future PR), ask the author to point to that planned coverage. - If uncertain, prefer the gentle **"Did you consider adding a release note?"** wording. + +## Attribution for content posted on a user's behalf + +This section applies to any agent acting through a user's GitHub account, including the Copilot CLI, the Copilot app, and the Copilot cloud agent. It does not apply to bots that post under their own identity, such as `copilot-pull-request-reviewer[bot]`, which are already attributed. + +Never publish AI-authored content under a user's name without saying that it was AI-assisted. Readers cannot tell the difference, and leaving them to assume a human wrote it misrepresents authorship. + +Add the following as the last line of the body: + +``` +_Assisted by GitHub Copilot._ +``` + +Apply this to: +- Pull request descriptions +- Issue bodies +- Review comments and replies in review threads +- Pull request and issue comments +- Discussion posts + +Notes: +- Git commit messages are already covered by the `Co-authored-by` trailer, so no additional line is needed there. +- Write the content in the user's voice, as them. The trailer records that assistance was used; it does not turn the content into a report about the agent. +- When editing existing content that does not have the trailer, add it. +- If the user explicitly asks for no attribution on a specific item, follow that. + From 744c0fed3f0ad45304a78b873af8bdac38736eeb Mon Sep 17 00:00:00 2001 From: Damyan Pepper Date: Mon, 17 Aug 2026 14:09:04 -0700 Subject: [PATCH 2/2] Make the attribution trailer name the actual agent The section claimed to apply to any agent acting through a user's account, but mandated a trailer naming GitHub Copilot specifically. An agent from another vendor following it would have replaced one authorship misrepresentation with another. Parameterize the trailer as "_Assisted by ._", keep "_Assisted by GitHub Copilot._" as the example, and give "_Assisted by an AI agent._" as the fallback when no product name applies. Also make the scope wording vendor-neutral. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e8b5337d-516d-45c2-aa9d-2efb79ebaf86 --- .github/copilot-instructions.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md index 34928c6760..6add4a7ad1 100644 --- a/.github/copilot-instructions.md +++ b/.github/copilot-instructions.md @@ -34,16 +34,18 @@ Comment tone: ## Attribution for content posted on a user's behalf -This section applies to any agent acting through a user's GitHub account, including the Copilot CLI, the Copilot app, and the Copilot cloud agent. It does not apply to bots that post under their own identity, such as `copilot-pull-request-reviewer[bot]`, which are already attributed. +This section applies to any AI agent acting through a user's GitHub account, whatever the vendor or product — for example the Copilot CLI, the Copilot app, or the Copilot cloud agent. It does not apply to bots that post under their own identity, such as `copilot-pull-request-reviewer[bot]`, which are already attributed by their username. Never publish AI-authored content under a user's name without saying that it was AI-assisted. Readers cannot tell the difference, and leaving them to assume a human wrote it misrepresents authorship. -Add the following as the last line of the body: +Add the following as the last line of the body, naming the agent that actually produced the content: ``` -_Assisted by GitHub Copilot._ +_Assisted by ._ ``` +For example, `_Assisted by GitHub Copilot._`. Name the agent you are, not a generic label and not another vendor's product. If you do not have a specific product name to use, write `_Assisted by an AI agent._` rather than guessing or naming something else. + Apply this to: - Pull request descriptions - Issue bodies