---
title: "Configure an agent with Copilot"
description: "Use Copilot to configure a coding agent, connect GitHub and a sandbox, review changes, and recover saved setup progress."
---

Copilot is the dashboard's assistant. Open the Copilot panel and choose
**Configure** to work on agent setup, or **Operate** to investigate recorded
activity and review proposed operational changes.

Configure contains the configuration workflow: agent settings, connection forms,
policy editing, proposal review, and client installation. There is no separate
configuration-agent launcher. Existing setup links open Configure in Copilot.
You can also use the full-page agent builder for the staged setup journey.

## Before you start

- Select the workspace and environment you intend to configure.
- Use an operator role that permits the requested change. Connection management
  and policy publication require an admin or owner; Control checks your role
  again when you apply a change.
- Bring your own accounts and credentials for the providers your application
  will call. Available connectors and tools depend on your workspace.

<Note>
Enter credentials only in the connection forms. Never paste a vendor key,
OAuth token, or Obol virtual key into the conversation.
</Note>

## Configure a coding agent

<Steps>
  <Step title="Open Configure">
    Open Copilot and select **Configure**. Start or continue setup from the
    displayed controls. If guided setup is disabled, a workspace owner can
    enable it. You can use the forms even when assistant inference is unavailable.
  </Step>
  <Step title="Describe the intended work">
    Give the agent a name and choose a coding workflow. When chat is available,
    you can ask: “Help me configure a coding agent with GitHub and sandbox
    connections.” Describe the repositories and tasks it should access, and
    whether it needs read, write, or destructive operations.
  </Step>
  <Step title="Connect GitHub and your sandbox">
    Select your GitHub connection and the exact tools the agent needs. Connect
    your sandbox provider through an available connector, or
    [add your own MCP server or REST API](/connectors/bring-your-own).
    Authenticate in the connection form and review the admitted tools.
    A connected provider does not automatically grant the agent access.
  </Step>
  <Step title="Set model access and boundaries">
    If the agent uses models, connect a
    [model provider](/routing/model-providers) and select its allowed models.
    Review tool access, policy, routing, budgets, and rate limits. Production
    destructive actions require approval unless policy explicitly grants them.
  </Step>
  <Step title="Review and apply">
    Inspect the proposed configuration before applying it. A proposal is bound
    to the saved setup revision; if the workspace changes, refresh and prepare
    a new proposal. Copilot's explanation is not authorization to apply.
  </Step>
  <Step title="Install and verify">
    Copy a newly minted virtual key when it is shown, then install the gateway
    addresses and key in your client. Run the intended model or tool call from
    that client and check the observed verification result. A saved draft or a
    successful assistant reply does not establish that your client is ready.
  </Step>
</Steps>

<Warning>
A new virtual key's plaintext is shown once. Save it before leaving the reveal.
If you lose it, revoke the key and mint a replacement; refreshing or replaying
an apply cannot recover its secret.
</Warning>

## Configure and Operate

| Mode | Use it for | What you review |
| --- | --- | --- |
| Configure | Agent setup, connections, policy, routing, key creation, and client installation | A setup proposal tied to a draft revision |
| Operate | Questions about recorded receipts, denials, routes, budgets, and operational changes | A workspace change set, with simulation when available |

You choose the mode. Both apply paths require your explicit action and Control's
permission checks. Setup key creation keeps the one-time secret separate from
stored operational change sets.

For tool results, read the receipt's evidence class. A native route can carry
`gateway_observed` evidence; a federated route carries `untrusted` or
`broker_attested` evidence. See [evidence trust](/receipts/evidence).

## Recover setup progress

If you see **Setup needs attention**, read the accompanying message before
retrying. An interrupted response does not establish whether a change committed.

- **The dashboard was updated:** reload the dashboard, reopen Configure or the
  agent builder, and inspect the saved setup before submitting another change.
- **Control is unavailable:** use **Refresh progress** when available to read
  the saved state. If the page itself is stale, reload it first.
- **The proposal is stale:** refresh the configuration and prepare a new proposal
  against the current revision.
- **Assistant inference is unavailable:** check the displayed readiness message.
  Continue with configuration forms where your workspace permissions allow it.
- **A key was minted but its secret is missing:** use the copy you saved, or
  revoke that key and mint a replacement.

If the failure persists, include the dashboard address, the button you pressed,
and the time of the attempt when reporting it. Do not include credentials.