Domain 6: Configure Privacy, Content Exclusions, and Safeguards

What Domain 6 tests

#

Domain 6 is the governance-and-safeguards slice of GH-300: content exclusions, enterprise and organization policies, public-code matching, output ownership, and troubleshooting. It is only 10–15% of the exam, and the details are specific.

Key point: content exclusions remove selected files from Copilot context and inline suggestions.

Content exclusions: what they do

#

Content exclusions tell Copilot to ignore selected files. Excluded files do not receive inline suggestions, do not inform suggestions in other files, do not inform Copilot Chat responses, and are not reviewed in Copilot code review. Content exclusion for GitHub Copilot

Content exclusion is a Copilot Business and Copilot Enterprise plan feature. Repository administrators can configure it for their repositories; organization owners can configure it for users assigned a Copilot seat through that organization; enterprise owners can configure it for the enterprise. Content exclusion for GitHub Copilot

Supported and unsupported surfaces

#

Content exclusions apply to specific supported surfaces. The support table includes IDEs, GitHub website Chat in public preview, GitHub Mobile Chat in public preview, and Copilot code review, with per-surface differences for inline suggestions and Chat. Content exclusion availability table

Configuring exclusions: repository, organization, enterprise

#

At repository level, use Settings → Copilot → Content exclusion and enter one path pattern per line. At organization level, use Organization settings → Copilot → Content exclusion and enter repository references with path lists. At enterprise level, use AI controls → Copilot → Content exclusion; enterprise rules apply across the enterprise, while organization rules apply to users seated by that organization. Excluding content from GitHub Copilot

Here is a realistic organization or enterprise configuration:

"*":
  - "**/.env"
  - "**/.env.*"
  - "**/secrets/**"
  - "**/*.{pem,key,p12}"
  - "**/customer-exports/**"

https://github.com/octo-org/payments-service.git:
  - "/src/generated/vendor/**"
  - "/docs/acquisition-targets/**"
  - "secrets.json"

git@github.com:*/copilot-labs:
  - "/__tests__/fixtures/private/**"
  - "*.internal.md"

Path syntax matters. A leading slash anchors the pattern at the repository root. A pattern without a slash, such as "secrets.json", can match anywhere. ** matches through directories, * matches characters in a path segment, ? matches one character, and brace patterns such as *.{pem,key,p12} match any listed extension. Patterns are case-insensitive and use Ruby fnmatch notation. Excluding content from GitHub Copilot

Propagation and local reload

#

After you add or change content exclusions, IDEs that already loaded settings can take up to 30 minutes to receive the change. You can reload manually: in VS Code, run Developer: Reload Window; in JetBrains IDEs and Visual Studio, close and reopen the application; in Vim/Neovim, exclusions are fetched each time you open a file. Testing changes to content exclusions

Policy hierarchy and who can override what

#

Copilot policies are set at the enterprise level first. Enterprise administrators can usually enable or disable a policy, or let organizations decide. Organization owners then manage policies for users licensed by the organization, unless the enterprise enforces the setting. GitHub Copilot policies for enterprises and organizations Managing Copilot in your organization Managing Copilot in your enterprise

When a user has seats from multiple organizations, some policies use the least restrictive organization setting, but sensitive settings can use the most restrictive setting. The suggestions-matching-public-code privacy policy is documented as most restrictive. Feature availability when policies conflict

Public-code matching and code references

#

Copilot checks suggestions for matches with publicly available code. Depending on the setting, a match can be discarded or suggested with a code reference showing matching public GitHub files and license information when found. The check compares potential suggestions and about 150 characters of surrounding code against an index of public repositories on GitHub.com; private GitHub repositories and non-GitHub code are not included. GitHub Copilot code referencing

Separate three concepts: exclusions remove selected files from context and suggestions; public-code matching checks generated output; code references are the visible attribution and license clues when matching suggestions are allowed or Block mode is unavailable. Finding public code that matches suggestions

Editor settings are not the same as content exclusions

#

Editors also have local Copilot settings. Users can enable or disable completions globally or by language and configure suggestion behavior. These settings change whether suggestions appear locally; they do not create enterprise-grade content exclusions. Configuring GitHub Copilot in your environment

Use editor settings for preference, content exclusions for privacy boundaries, and Copilot policies for plan-wide feature, model, client, and privacy controls.

Ownership, responsibility, and output limits

#

Current GitHub Generative AI Services Terms say GitHub does not own Inputs or Outputs, customers retain existing ownership in Inputs, and GitHub will not use Inputs or Outputs to train models without documented instructions. For subscriptions and renewals before 5 March 2026, the GitHub Copilot Product Specific Terms say GitHub does not own Suggestions and users retain ownership of their code. GitHub Generative AI Services Terms GitHub Copilot Product Specific Terms

Users are responsible for reviewing and validating suggestions before accepting them. Inline suggestions can be inaccurate, biased toward common patterns, semantically wrong, or risky in security-sensitive code. Mitigate with review, testing, secure practices, filters, and policy controls. Responsible use — inline suggestions

For Business and Enterprise, code snippets are not retained after suggestion generation, and code is not used for training. Do not publish unsupported precision such as a specific chat-retention number unless it appears in current official documentation. GitHub Copilot Trust Center

BYOK: what the acronym means

#

BYOK is model governance, not content exclusion. Organization custom models Enterprise custom models

Auditing privacy and safeguard changes

#

Copilot audit logs include plan, setting, policy, license, and website agent activity events. Use action:copilot; events are retained for 180 days. For organization API access, remember GET /orgs/{org}/audit-log?phrase=action:copilot. Reviewing audit logs for GitHub Copilot

Audit logs do not include local prompt text. Reviewing audit logs for GitHub Copilot

Troubleshooting scenarios

#

If Chat can still explain an excluded file, close other tabs, attach that file, and ask explain this file. If exclusion works, Copilot should not list the file as a reference. If it still does, reload the IDE, verify scope and path syntax, and confirm you are not using unsupported Agent mode. Testing content exclusions

If an exclusion seems partial, remember two limitations: Copilot may receive indirect semantic information from the IDE, and exclusions do not currently apply to symbolic links or repositories on remote filesystems. Content exclusion limitations

If public-code references do not appear, check whether the policy is Block. References appear when matching suggestions are allowed or Block mode is unavailable. Inline references are logged only for accepted Copilot suggestions that match public code. GitHub Copilot code referencing

Check yourself

#