Copilot code review: choose who may request it before choosing who pays

Two settings answer different questions

GitHub's 8 October announcement gives organization owners a choice of payer for Copilot code review and gives organization owners and repository administrators a separate way to restrict who can request it. For a team using coding agents, the useful distinction is simple: permission to request a review and entitlement to pay for one are different decisions. [1]

By default, people with a paid Copilot license can request review in repositories they already have access to. The new requester restriction can instead require a license supplied by the organization or enterprise. Changing the billing policy does not itself grant access to Copilot code review. [1][2]

Member or Organization billing

The announcement places the choice in the organization's Copilot Policies settings; current documentation also names enterprise owners as administrators. Our recommendation is to retain Member when the intended policy is to use members' entitlements, or consider Organization when the team deliberately wants these eligible reviews billed centrally. Neither choice is a claim of lower total cost. [1][2]

For Copilot Business and Enterprise, GitHub says reviews are blocked when the applicable budget is exhausted: the user budget for user-billed usage, or the applicable organization budget, cost-center budget or enterprise spending limit for organization-billed usage. Check which limits actually exist in your account. Selecting Organization alone does not establish a hard invoice cap. GitHub also separates AI credits for the model interaction from Actions minutes for agentic capabilities; an AI-credit limit is not evidence of an Actions spending ceiling. [2]

Check license provenance and the request route

The setting is named Only allow Copilot code review to be triggered by authorized users. Here, the restriction concerns where the Copilot license comes from. An external license can be a personal license or one from another organization. Organization owners and repository administrators can enable the restriction, but repository administrators cannot disable it when the organization has enabled it. Existing repository permissions remain a separate requirement. [1][2]

• With the restriction enabled, Copilot is not offered as a reviewer to unauthorized people, and API review requests from those people do not start a review. [2]
• Unauthorized people's automatic reviews from personal settings do not run. Automatic reviews configured through repository or organization rulesets still run; the restriction is not a blanket switch that disables every review. [2]
• In the same applicability section, GitHub says that in personal repositories only the owner or a direct collaborator can request a review. Do not extend organization-owned-repository billing to a personal repository from this rule. [2]

Feature access also depends on the account and platform. If your Copilot license comes from an organization, GitHub says that organization must enable code review for GitHub.com or GitHub Mobile. Separately, Business and Enterprise organizations can enable review for members without a Copilot license on GitHub.com. That requires paid AI-credit usage and the explicit no-license sub-policy, which is disabled by default; no-license review is not available in IDEs. Organization billing does not turn that capability on. Have an administrator resolve combinations of the no-license and requester policies rather than assuming their outcome. [2]

Agent-authored does not identify the payer

GitHub's default attribution is to the pull-request author when review is requested automatically, and to the requesting user for a manual request. Read that alongside the selected billing policy, not as a rule that the author always pays. [2]

• For a pull request authored by Copilot cloud agent, usage is first attributed to the human co-author associated with the change. If that co-author cannot be billed, GitHub bills the organization. [2]
• For other bot-authored pull requests, or when a bot requests review, GitHub documents direct organization billing. This does not prove that every bot or API credential is authorized to start a review. [2]

Our recommendation is to identify both the author and the requester in an agent workflow, including any human co-author, before predicting usage attribution. Where the documentation does not settle your combination of bot identity, API credential and policy, make that a specific administrator check rather than assigning a payer by analogy.

Our recommended read-only check order

Use this order to decide a policy, not as an instruction to enable paid usage or change settings without authority. It is our recommendation, not a GitHub-mandated workflow.

• 1. Identify the repository owner, the requester and their existing repository access. Confirm that the account and platform support the intended review capability.
• 2. Check the requester's license provider and the effective authorized-user setting at organization and repository level. Do not treat a local toggle as an override of an organization restriction.
• 3. Identify the trigger: manual interface, API, personal automatic-review setting or repository/organization ruleset. For agent or bot activity, also identify the author and any human co-author.
• 4. For eligible licensed-member reviews, check Member versus Organization billing. Before recommending Organization, confirm paid usage, applicable budgets and spending limits, and Actions accounting separately.
• 5. Keep the team's required human or owner review and other merge checks. If an outcome-changing account setting or identity is unresolved, stop the policy decision there and ask the responsible administrator to confirm it.

A completed hypothetical team decision

Assume a fictional organization-owned repository with code review enabled. Two human organization members already have repository access: Mira has a paid Copilot seat supplied by this organization; Jon has only a personal paid Copilot license. The organization enables the authorized-user restriction and selects Organization billing with paid usage enabled. It retains a separate human-review requirement. No budget or available balance is assumed, and no review request has been executed.

The team's completed decision is to fund eligible licensed-member reviews centrally while keeping the license-provenance restriction. It does not make an exception for Jon merely because the organization is paying. Before relying on automatic review, the administrator must resolve ruleset attribution and applicable spending limits. The separate human-review requirement remains in place.

Payment and approval still do not establish review quality

By default, Copilot reviews do not count toward required pull-request approvals. Current documentation also describes Copilot approvals in public preview: when enabled in the relevant repository, organization and enterprise settings, Copilot can submit an approval that satisfies a required-approval rule. That mechanical count does not establish an independent human review or a quality certification. GitHub says Copilot can miss problems and make mistakes, and recommends validating its feedback and supplementing it with human review. [2]

These conclusions come from two GitHub primary pages, not an independent test. Actual rollout, repository settings, API credential applicability and available quotas or budgets remain account checks. Recheck the linked policies before applying the decision to a real team; this briefing makes no price, savings or review-effectiveness claim.