Add Permissions Section for Using Copilot CLI Doc (#59007)

Co-authored-by: hubwriter <[email protected]>

Author: MRayermannMSFT

content/copilot/how-tos/use-copilot-agents/use-copilot-cli.md

@@ -74,6 +74,40 @@ Install {% data variables.copilot.copilot_cli_short %}. See [AUTOTITLE](/copilot
 
    For example, if you ask {% data variables.product.prodname_copilot_short %} to create a bash script but you do not want to use the script {% data variables.product.prodname_copilot_short %} suggests, you can stop the current operation and enter a new prompt, such as: `Continue the previous task but include usage instructions in the script`.
 
+## Permissions
+
+{% data variables.copilot.copilot_cli_short %} uses a permissions system to control access to paths and URLs. At times, path and URL permission checks utilize heuristic-based detection, which has limitations to be aware of.
+
+### Path permissions
+
+Path permissions control which directories and files {% data variables.product.prodname_copilot_short %} can access. By default, {% data variables.copilot.copilot_cli_short %} can access the current working directory, its subdirectories, and the system temp directory.
+
+Path permissions apply to shell commands, file operations (create, edit, view), and search tools (such as `grep` and glob patterns). For shell commands, paths are heuristically extracted by tokenizing command text and identifying tokens that look like paths.
+
+> [!WARNING]
+> Path detection for shell commands has limitations:
+>
+> * Paths embedded in complex shell constructs may not be detected.
+> * Only a specific set of environment variables are expanded (`HOME`, `TMPDIR`, `PWD`, and similar). Custom variables like `$MY_PROJECT_DIR` are not expanded and may not be validated correctly.
+> * Symlinks are resolved for existing files, but not for files being created.
+
+To disable path verification, use the `--allow-all-paths` flag when starting {% data variables.copilot.copilot_cli_short %}.
+
+### URL permissions
+
+URL permissions control which external URLs {% data variables.product.prodname_copilot_short %} can access. By default, all URLs require approval before access is granted.
+
+URL permissions apply to the `web_fetch` tool and a curated list of shell commands that access the network (such as `curl`, `wget`, and `fetch`). For shell commands, URLs are extracted using regex patterns.
+
+> [!WARNING]
+> URL detection for shell commands has limitations:
+>
+> * URLs in file contents, config files, or environment variables read by commands are not detected.
+> * Obfuscated URLs (such as split strings or escape sequences) may not be detected.
+> * HTTP and HTTPS are treated as different protocols and require separate approval.
+
+To disable URL verification, use the `--allow-all-urls` flag. To pre-approve specific domains, use `--allow-url <domain>` (for example, `--allow-url github.com`).
+
 ## Tips
 
 Optimize your experience with {% data variables.copilot.copilot_cli_short %} with the following tips.