GitHub's new issue automations can now label, type, assign, or close issues with a confidence level and a rationale. That sounds like a small UX improvement. It is actually a policy-design problem: a model's confidence is a guess about its own output, while authorization is a rule about what the system is allowed to change.
If you let those concepts collapse into one threshold, you can build an automation that is easy to operate and hard to govern. This guide turns the preview into a reviewable policy: automate low-impact metadata only when the action is reversible, keep ambiguous changes in a suggestion queue, and put security-sensitive decisions behind a real control boundary.
Scope note: GitHub describes rationale, confidence, and approvals as a public preview. The examples below are a policy template, not a claim that the preview is a security product.
What GitHub actually added
GitHub's July 23 changelog describes three controls for supported issue actions:
