Rulesets have been enforceable for a while. What has been missing is the answer to the only question that matters afterwards: is anybody actually following them?
On 12 August, rule insights went to the organization level in public preview. It aggregates rule evaluations across every repository you own — allowed, failed and bypassed — rather than making you open them one at a time.
What it gives you
The dashboard lives in your organization's Settings, under the Repository tab, and it does four things:
- Aggregates rule evaluation metrics across all repositories in the organization
- Surfaces the repositories with the most bypasses, so review effort goes where it is warranted
- Filters by evaluation status, branch, ruleset and date range
- Exports to CSV, which is the format compliance evidence actually needs to arrive in
Bypasses are the number to watch
Allowed and failed runs are routine — a rule did its job either way. The bypass count is the one that carries information, because a bypass is a person deciding the rule should not apply this time.
A handful of bypasses is healthy; rules that can never be bypassed get worked around in worse ways. A repository with a consistently high bypass rate is telling you something specific: either the rule is wrong for that codebase, or the team has learned to treat the bypass as part of the normal flow. Those need opposite responses, and you cannot tell which is which from a total.
This is why the "most bypasses" view is the useful one. It turns an unbounded audit into a short list.
Why this is arriving now
Repository-level rule insights shipped in April. Rolling it up to the organization is the natural sequel, and it lands in the middle of a month where GitHub has shipped governance feature after governance feature: MCP allowlists, organization-level pull request limits, plugin controls, per-model billing detail.
The common thread is scale. Every one of these features exists because a control that worked when you checked it by hand stops working when the volume of activity outgrows the number of people reviewing it. Agents are a large part of why that volume grew.
It is a preview, so plan accordingly
Public preview means the interface and the data can still change. That is fine for finding out where your bypasses are concentrated; it is early for building a compliance process that assumes the CSV columns are stable.
A sensible first use: export once, look at the top five repositories by bypass count, and go and ask those teams why. The conversation will be more informative than the dashboard, and the dashboard is what told you which conversation to have.