GitHub Copilot in Slack Moved the Approval Gate. It Left the Meter Alone.

Shared agent sessions landed in Slack and Teams on the same morning. The permission model is careful, the spend controls are all opt-in, and the credit allowance that makes it look cheap expires on September 1.

Read GitHub's two changelogs from August 21 side by side and one sentence stands out for being oddly specific. In the Microsoft Teams post, describing the new option to require an extra approval on any pull request attributed to the Microsoft Teams Copilot integration identity: "If you require two approvals in a repository, with this enabled you will need three for Copilot-created pull requests." The Slack post grants the same control over its own Copilot app identity.

Three humans. That is a company thinking hard about what happens when a bot opens a PR. Now search either changelog for what one agent session costs. You get a pointer to a budget page instead of a number.

Both posts shipped within minutes of each other, both put @GitHub into a team chat window, and both are careful about who can change code. Both name the meters too, to be fair. What neither does is tell you what a session draws, or suggest you set a ceiling before you start. The controls exist. Every single one of them is something you have to go turn on.

The gate they built is good. It's the wrong gate to have built alone.

Give GitHub credit for the permission work, because it is more thoughtful than the marketing suggests.

Mention @GitHub in a Slack channel or thread and Copilot opens a dedicated code channel where the team can follow the plan, inspect diffs, preview HTML artifacts, redirect the approach, or stop the session outright. That is genuinely useful. It also raises the obvious question of who gets to do what, and the docs answer it plainly: "Only users with write access to a repository can trigger Copilot to make changes, but any conversation participant can provide input." Workspace guests and outside collaborators cannot start or steer a session at all (GitHub Docs). Teams draws the same line.

So the write boundary holds. The review boundary got stronger. A repository admin can now demand an additional approving human before agent-authored work merges, on top of whatever the branch protection already required.

Here's what that boundary does not cover. Starting a cloud agent session is not a write to your repository. It is a request for compute and inference, and it is metered.

Four meters, one @-mention

An agent session started from Slack or Teams draws on two separate billing systems, and one of those systems has three meters inside it.

The agent itself consumes AI credits. GitHub's billing docs price these at a flat rate: 1 AI credit equals $0.01 USD. Each Copilot Business seat includes 1,900 credits per user per month, Copilot Enterprise includes 3,900, and the credits pool at the billing entity rather than sitting in per-person buckets. A hundred Business seats means a shared pool of 190,000 credits. Unused credits do not carry over. The pool resets at 00:00:00 UTC on the first of the month.

The cloud sandbox where the agent actually runs code bills separately, on three meters of its own: compute at $0.000024 per compute-second, memory at $0.000003 per GiB-second, and snapshot storage at $0.005 per GiB-month. Compute works out to about nine cents an hour. Memory runs about a penny per GiB-hour.

I want to be fair here, because the alarming-sounding numbers are the small ones. Sandbox compute is cheap. If your worry is that a runaway Slack channel will burn a fortune in container time, the arithmetic does not support the panic.

The storage meter is the one with a sharp edge on it. GitHub keeps a snapshot when you stop a sandbox so you can resume, and that snapshot bills "from the time the sandbox is stopped until the sandbox is deleted." Stopping is not the same as finishing. The session you closed on Friday is still a line item on Monday.

And there is a timing problem that has nothing to do with either meter.

The allowance expires in eleven days

GitHub's usage-based billing docs contain a table most people will read once and forget. Existing Copilot Business and Enterprise customers get an inflated credit allowance for the first three months of usage-based billing, running June 1 to September 1, 2026. During that window, Business seats carry 3,000 credits per user per month instead of 1,900, and Enterprise seats carry 7,000 instead of 3,900.

September 1 is eleven days from the day these integrations shipped.

For a Business seat, that is a drop from $30 of included inference to $19, a cut of roughly 37 percent. Enterprise falls from $70 to $39, closer to 44 percent. Any team that turns on shared agent sessions this week and reads the usage report in early September will be comparing two months that were never measured on the same scale.

The cloud sandbox trial already ended. GitHub's docs describe a $10 monthly entitlement to try cloud sandboxes "available through the end of July 2026," after which "the entitlement no longer applies and all usage is billed."

One more setting matters more than any of the above. Paid overage past your included credits is enabled by default for organizations and enterprises. To prevent any spending beyond the pool, an administrator has to go into AI Controls and explicitly disable the AI credits paid usage policy. Nobody gets asked. The default is yes.

The question the docs do not answer

Cloud sandbox usage bills to the account that owns the sandbox, and if you are working inside a repository, the repository owner is billed. That part is clear.

The AI credit side is where a shared session gets strange. Budgets exist at the user level, the cost-center level, the organization level, and as an enterprise-wide spending limit, and a $0 user-level budget blocks that person immediately. Those controls all assume one identifiable person is driving.

A Slack code channel does not work that way. One teammate types @GitHub, four more join from the original thread, add context, and redirect the approach, and the session keeps running while everyone goes to lunch. GitHub's documentation does not say whose user-level budget a redirected session draws down. That is not me implying a bug. It is a real, answerable question that I could not resolve from the public docs, and it is the first thing I would put to an account team before enabling this org-wide.

There is a smaller gotcha in the same family. Each Slack channel has a default repository, and if the channel doesn't have one, Copilot sets the repo from the first session anyone runs there. The docs are explicit that "the default repository is shared across the channel, so any change applies to everyone using Copilot in that channel." A shared mutable setting that the first person to use the feature configures by accident is a support ticket waiting to happen.

Put this into practice

If you are turning this on next week, do these in order. It takes about twenty minutes and it is all admin console work, no code.

1. Kill the default overage first. In your enterprise or organization AI Controls settings, disable the AI credits paid usage policy. You can turn it back on deliberately once you know your baseline. Leaving it on by default means your first month of shared sessions has no ceiling.
2. Set a product-level budget for cloud sandboxes and check "Stop usage when budget limit is reached." Cloud sandboxes are not covered by the Bundled AI credits budget type, so an AI credits budget alone leaves the sandbox meters uncapped. A product-level or SKU-level budget with that box checked is the only hard stop available for them.
3. Set user-level AI credit budgets before the first session, not after. A $0 budget blocks a user immediately, which makes it a usable kill switch for a specific person or a specific test.
4. Start in one channel with triage only. Ask Copilot to investigate failures and update issues. Do not hand it code changes on day one. You learn the interaction pattern and your team learns the prompting norms at close to zero inference cost.
5. Set that channel's default repository by hand. Do not let the first ad hoc session pick it for everyone.
6. Delete finished sandboxes, don't just stop them. Snapshot storage meters from the moment you stop until the moment you delete. Archiving the Slack code channel is a separate action with no billing effect at all, and it is worth doing on its own terms: the channel stays viewable, searchable, and reopenable afterward.
7. Read the usage report on September 2, and again on October 2. The first number sits inside the promotional allowance. The second one does not. Only the second tells you what this actually costs.

Honest limitations

I have not run a month of shared agent sessions through a real team, and neither has anyone else, because both integrations entered public preview today. Everything here is read off primary documentation and priced with arithmetic, not measured against a bill.

The scary framing does not entirely survive contact with the pricing table. Sandbox compute at nine cents an hour is not going to bankrupt anyone, and GitHub does publish the meters, the rates, and the budget controls in enough detail that a careful admin can build a ceiling. That is more transparency than most agent products offer.

What GitHub does not publish is the credit cost of a typical cloud agent session, which is the number you actually need. Without it, "1,900 credits per user per month" is a quantity of an unknown unit. You cannot plan against it until you have run enough sessions to learn your own conversion rate, which means the first month is the experiment whether you wanted it to be or not.

The plan availability also differs between the two posts in a way worth checking against your own contract. The Slack changelog names Copilot Business and Copilot Enterprise. The Teams changelog says the preview is available "with paid GitHub Copilot plans," which reads broader. If your team is on Copilot Pro, verify before you promise anyone anything.

And the permission model, to say it once more, is good. The write boundary is real, the guest exclusion is sensible, and the extra-approval option is the kind of control enterprise buyers ask for and rarely get. My argument is not that GitHub was careless. It is that they solved the review problem completely and the spend problem partially, on the same day, in the same feature.

What to do with this

The pattern to take away is not about GitHub. Every agent product moving from a private terminal into a shared channel inherits the same asymmetry, because permission models were designed around who may change things and billing models were designed around who is typing. A shared session breaks the second assumption and leaves the first one intact.

So when the next vendor puts an agent in your team chat, ask the two questions in order. Who can start a metered session, and where is the ceiling that stops it? If the answer to the second one is "the org budget," you have found the thing that will surprise you, and you have found it before your finance team does.

Set the budget first. Turn the feature on second.

Sources: GitHub Changelog: The new GitHub Copilot experience in Slack, GitHub Changelog: Shared agentic work with GitHub Copilot in Microsoft Teams, GitHub Docs: Integrating Copilot cloud agent with Slack, GitHub Docs: Billing for cloud and local sandboxes, GitHub Docs: Usage-based billing for organizations and enterprises. All figures read on August 21, 2026.