add-policy

# Adding a Configuration Policy Policies allow enterprise administrators to lock configuration settings via OS-level mechanisms (Windows Group Policy, macOS managed preferences, Linux config files) or via Copilot account-level policy data. This skill covers the complete procedure. ## When to Use - Adding a new `policy:` field to any configuration property - Modifying an existing policy (rename, category change, etc.) - Reviewing a PR that touches policy registration - Adding account-based policy support via `IPolicyData` - Wiring an enterprise **managed setting** (native MDM / GitHub server) — see **[github-managed-settings.md](./github-managed-settings.md)** - Having one policy govern **multiple** settings via `policyReference` - **Testing** account/managed-settings policies locally without the real backend — see **[local-testing.md](./local-testing.md)** ## Architecture Overview ### Policy Sources (layered, last writer wins) | Source | Implementation | How it reads policies | |--------|---------------|----------------------| | **OS-level** (Windows registry, macOS plist) | `NativePolicyService` via `@vscode/policy-watcher` | Watches `Software\Policies\Microsoft\{productName}` (Windows) or bundle identifier prefs (macOS) | | **Linux file** | `FilePolicyService` | Reads `/etc/vscode/policy.json` | | **Account/GitHub** | `AccountPolicyService` | Reads `IPolicyData` from `IDefaultAccountService.policyData`, applies `value()` function. Server-delivered managed settings arr...