What changed
GitHub added a remoteControl managed setting that can require SSO, disable remote control, or permit it. Policies can be distributed through a private repository, device management, or local files.
Why it matters
Remote agent control extends the security boundary from identity and repository access to the endpoint that hosts each active session.
What to do
Require managed devices and SSO for remote sessions, then test unmanaged and incorrectly configured endpoints to prove the restriction is enforced.
Caveat
This governs session eligibility, not actions inside an authorized session. Repository permissions, secrets, execution isolation, and approval policy remain separate controls.