Prepare Agent Architecture and SDLC Processes
15-20%of exam
Implement Tool Use and Environment Interaction
20-25%of exam
Manage Memory, State, and Execution
10-15%of exam
Perform Evaluation, Error Analysis, and Tuning
15-20%of exam
Orchestrate Multi-Agent Coordination
15-20%of exam
Implement Guardrails and Accountability
10-15%of exam
Risk ClassificationAutonomy LevelsLeast PrivilegeAuthorization Gates
Quick Facts
- Exam code
- GH-600
- Exam title
- Developing in Agentic AI Systems
- Credential
- GitHub Certified: Agentic AI Developer
- Maintainer
- GitHub
- Exam provider
- Microsoft
- Level
- Intermediate
- Exam time
- 120 minutes
- Question count
- Not published
- Passing score
- 700/1000 scaled
- Domains
- Six
- Language
- English
- Delivery
- Proctored through Pearson VUE
- Components
- Interactive items may appear
- First retake
- Wait 24 hours
- Later retakes
- Wait 14 days
- Attempt limit
- Five within 12 months
- Credential validity
- Not published
- In-exam Learn
- Unavailable for GitHub exams
- Blueprint update
- May 13, 2026
IOS Task Contract
Inputs, outputs, success before execution
InputsOutputsSuccess criteria
Credential vs Exam
Credential
- Agentic AI Developer
- Maintained by GitHub
- Earned after passing
Exam
- GH-600
- Developing in Agentic AI Systems
- Provided by Microsoft
Credential name differs from exam title
Architecture and Control Picker
- Task is underspecified→Define inputs, outputs, success(Set boundaries)
- Actions begin before review→Separate planning from execution(Add action gate)
- Intent is hard to inspect→Emit structured plan(Make steps reviewable)
- Plan exceeds scope→Reject or revise plan(Validate first)
- Action carries material risk→Require human approval(Right-size intervention)
- Work runs autonomously→Produce inspectable artifacts(Enable oversight)
- Operator may need control→Configure intervention path(Avoid delivery blockage)
- Action is low-risk reversible→Allow proportionate autonomy(Minimize needless approvals)
Agent Task Design
- SDLC integration
- Places agents within development workflows
- Task boundary
- Limits agent responsibilities
- Input
- Information available before work
- Output
- Required deliverable or artifact
- Success criterion
- Observable completion condition
- Operational constraint
- Boundary on permitted execution
- Agent anti-pattern
- Recurring harmful design choice
- Planning
- Defines intended action sequence
- Reasoning
- Selects and justifies approach
- Execution
- Performs permitted actions
- Structured plan
- Reviewable ordered action proposal
- Plan validation
- Checks scope, safety, and feasibility
Plan Control Cycle
Plan, validate, authorize, execute, trace
PlanValidateAuthorizeExecuteTrace
GH-600 vs GH-300
GH-600
- Agentic AI systems
- Multi-agent orchestration
- Production guardrails
GH-300
- GitHub Copilot certification
- Separate exam blueprint
- Not this exam
Agent operations versus Copilot certification
Observability and Control
- Inspectable artifact
- Reviewable evidence of agent work
- Log
- Timestamped event record
- Trace
- Linked execution path
- Workflow output
- Result produced by automation
- Human intervention
- Operator changes or halts behavior
- Action gate
- Blocks execution pending approval
- Autonomy
- Permitted independent action
- Control plane
- GitHub governs agent operations
- System of record
- Authoritative durable workflow evidence
- Review checkpoint
- Human validates before continuation
GH-600 vs AI-102
GH-600
- GitHub control plane
- Agentic SDLC workflows
- GitHub credential
AI-102
- Azure AI solutions
- Different skills measured
- Microsoft Azure credential
GitHub agents versus Azure AI
Planning vs Execution
Planning
- Proposes intended actions
- Produces structured plan
- Validated before action
Execution
- Performs permitted actions
- Uses configured tools
- Produces traceable artifacts
Review intent before effects
MCP Allowlist vs Registry
Allowlist
- Controls permitted servers
- Policy enforcement
- Reduces unsafe access
Registry
- Catalogs MCP servers
- Supports discovery
- Stores server metadata
Permission versus discovery
Tool and Execution Picker
- Agent lacks required capability→Select and configure tool(Grant minimum access)
- Agent needs external context→Configure MCP server(Expose required capability)
- MCP choices need control→Apply allowlist policy(Permit approved servers)
- Work targets one repository→Apply repository scope(Limit blast radius)
- Changes need isolation→Apply branch scope(Review through pull request)
- Automation should invoke agent→Integrate CI workflow(Check execution context)
- Failure appears transient→Retry with limits(Record each attempt)
- Partial changes are unsafe→Roll back state(Restore known-good point)
- Recovery remains uncertain→Escalate with evidence(Preserve traceability)
Tool Scope
- Tool selection
- Matches capability to task
- Tool configuration
- Defines tool behavior and connection
- Tool permission
- Controls allowed tool actions
- Execution context
- Environment surrounding agent work
- Repository scope
- Limits work to one repository
- Branch scope
- Confines changes to assigned branch
- CI invocation
- Starts agent from workflow
- Branch creation
- Isolates proposed repository changes
- Pull request creation
- Presents changes for review
- Environment constraint
- Limit specific to execution environment
- Least privilege
- Minimum access required
Retry vs Rollback
Retry
- Attempts operation again
- Fits transient failure
- Needs limits and trace
Rollback
- Reverses partial effects
- Restores known-good state
- Fits unsafe residue
Repeat versus restore
MCP Configuration
- MCP
- Standard connecting models, tools, data
- MCP server
- Exposes tools or context
- GitHub remote MCP
- Remote GitHub tool integration
- MCP registry
- Catalogs discoverable MCP servers
- MCP allowlist
- Permits approved MCP servers
- Managed settings
- Enforces MCP client configuration
- Tool exposure
- Makes server capability available
- Server permission
- Scopes accessible server actions
- Approved server
- Server authorized by policy
- Registry entry
- Metadata supporting server discovery
Safe Execution
- Error handling
- Controlled response to failure
- Retry
- Repeats eligible failed operation
- Rollback
- Restores known-good state
- Escalation
- Hands unresolved issue to human
- Traceability
- Links actions to evidence
- Checkpoint
- Recoverable progress boundary
- Failure signal
- Evidence execution degraded
- Partial failure
- Only some work completes
- Safe path
- Controlled execution and recovery route
- Accountability
- Actions remain attributable and reviewable
Memory vs State
Memory
- Retains relevant information
- Needs scope and pruning
- May be short-term
State
- Tracks execution progress
- Persists decisions and status
- Enables accurate resume
Knowledge versus workflow position
Memory and Evaluation Picker
- Context serves current task→Use short-term memory(Keep task-relevant)
- Work must resume later→Persist durable artifacts(Record progress and decisions)
- State crosses tools→Share explicit state(Prevent conflicting context)
- Context may be stale→Refresh and validate(Check current environment)
- Execution drifts from decisions→Detect and correct drift(Use decision record)
- Success is ambiguous→Define evaluation signals(Align development intent)
- Machine checks are available→Generate automated signals(Use scanning tools)
- Agent output fails→Inspect logs, plans, traces(Classify root cause)
- Reasoning caused failure→Revise instructions or constraints(Retest behavior)
- Tool use caused failure→Refine tool usage(Adjust access if needed)
Memory Strategy
- Short-term memory
- Current task working context
- Long-term memory
- Persists beyond current execution
- External memory
- State outside active context
- Task relevance
- Excludes unrelated stored information
- Expiration
- Removes memory after defined time
- Pruning
- Removes low-value context
- Reset
- Clears selected memory or state
- Repository fact
- Repository-scoped shared knowledge
- User preference
- User-scoped interaction preference
- Memory scope
- Defines permitted information boundary
Short-Term vs Long-Term Memory
Short-term
- Current task context
- Temporary
- Prune aggressively
Long-term
- Persists across execution
- Needs expiration rules
- Validate before reuse
Working context versus persistence
Durable State
- Durable artifact
- Persistent progress evidence
- Decision record
- Preserves why choice was made
- Progress record
- Tracks completed and remaining work
- State continuity
- Preserves work across tools
- Resume
- Continues without repeating steps
- Context drift
- Execution diverges from prior decisions
- Stale context
- Outdated task or environment state
- Conflicting context
- Shared information disagrees
- Shared state
- Coordinated cross-agent information
- State handoff
- Transfers progress with evidence
Failure Roots
Reasoning, tool, context, environment
Reasoning errorTool misuseContext issueEnvironment issue
Reasoning Error vs Tool Misuse
Reasoning error
- Plan or logic flawed
- Tool may work correctly
- Tune instructions or constraints
Tool misuse
- Tool applied incorrectly
- Parameters or sequence wrong
- Tune usage or access
Wrong thinking versus wrong operation
Evaluation Signals
- Expected outcome
- Intended task result
- Qualitative signal
- Judgment-based quality evidence
- Quantitative signal
- Numeric performance evidence
- Automated scan
- Machine-generated evaluation signal
- Development intent
- Team's actual delivery objective
- Acceptance criterion
- Measurable pass condition
- Evaluation baseline
- Reference for result comparison
- Test result
- Behavior correctness signal
- Security finding
- Automated risk signal
- Operational signal
- Evidence of runtime behavior
Evaluation vs Observability
Evaluation
- Judges task success
- Uses aligned signals
- Drives tuning
Observability
- Exposes agent behavior
- Produces logs and artifacts
- Enables diagnosis
Judge outcome versus expose behavior
Failure Evidence and Tuning
- Reasoning error
- Flawed analysis or plan
- Tool misuse
- Wrong tool, parameters, or sequence
- Context issue
- Missing, conflicting, or stale information
- Environment issue
- Incompatible execution conditions
- Root cause
- Underlying failure mechanism
- Plans
- Evidence of intended actions
- Outputs
- Evidence of resulting artifacts
- Instruction tuning
- Revises workflows or constraints
- Memory tuning
- Refines stored context usage
- Tool tuning
- Refines usage and access
Multi-Agent Loop
Isolate, observe, hand off, recover
IsolateObserveHandoffRecover
Orchestration and Guardrail Picker
- Subtasks are independent→Run isolated parallel agents(Assign clear ownership)
- Subtasks have dependencies→Sequence documented handoffs(Transfer state explicitly)
- Agents edit overlapping scope→Serialize or reassign(Prevent change conflicts)
- Agents duplicate effort→Clarify ownership boundaries(Stop redundant work)
- Outputs contradict→Reconcile before integration(Record final decision)
- Execution stalls or degrades→Activate recovery pattern(Use artifacts and signals)
- Agent lifecycle changes→Preserve audit and continuity(Add, replace, or retire)
- Action violates policy→Block action(Do not merely warn)
- Change is irreversible→Require explicit authorization(Use controlled path)
Agent Coordination
- Orchestration pattern
- Coordinates multiple agent roles
- Agent isolation
- Separates parallel execution contexts
- Parallel execution
- Agents work concurrently
- Overlapping changes
- Agents edit same scope
- Duplicated effort
- Agents repeat same task
- Contradictory outputs
- Agent conclusions cannot coexist
- Handoff
- Transfers work and evidence
- Key decision
- Recorded coordination choice
- Post-hoc analysis
- Reviews completed agent behavior
- Audit artifact
- Supports later workflow review
Multi-Agent Recovery
- Failed execution
- Agent cannot complete work
- Partial execution
- Agent completes incomplete subset
- Stalled execution
- Agent stops making progress
- Degraded behavior
- Coordination quality worsens
- Recovery pattern
- Restores coordinated workflow progress
- Human-in-the-loop
- Human judgment enters workflow
- Add agent
- Introduces new workflow participant
- Reconfigure agent
- Changes role without disruption
- Replace agent
- Substitutes workflow participant
- Retire agent
- Removes agent while preserving continuity
Risk Controls Autonomy
Higher risk means tighter control
Classify riskSet autonomyGate sensitive action
Autonomy vs Unrestricted Access
Autonomy
- Risk-adjusted authority
- Defined boundaries
- Inspectable actions
Unrestricted access
- Excessive permissions
- Undefined action scope
- Avoid this design
Independence still needs boundaries
Risk and Autonomy
- Risk classification
- Groups actions by consequences
- Operational risk
- Threatens workflow reliability
- Security risk
- Threatens systems, data, or access
- Compliance risk
- Threatens regulatory or policy obligations
- Autonomy level
- Determines independent authority
- Human judgment
- Manual decision required
- Policy block
- Prevents forbidden action
- Explicit authorization
- Deliberate approval to act
- Irreversible change
- Cannot readily be undone
- Compliance-sensitive change
- Requires controlled execution path
- Responsible AI
- Organizational AI behavior standards
- Low-value approval
- Does not materially reduce risk
Common Traps
Scaled Score Is Not Percentage
Passing score is 700/1000 ≠ Raw 70% is not guaranteed
Time Is Not Question Count
Exam time is 120 minutes ≠ Question count is unpublished
Credential Is Not Exam Title
Credential: Agentic AI Developer ≠ Exam: Developing in Agentic AI Systems
GH-600 Is Not GH-300
GH-600 covers agentic systems ≠ GH-300 is Copilot certification
GH-600 Is Not AI-102
GH-600 uses GitHub control plane ≠ AI-102 covers Azure AI solutions
Plan Is Not Execution
Plan proposes reviewable actions ≠ Execution creates effects
Memory Is Not Infinite Context
Memory needs scope and pruning ≠ Irrelevant context increases drift
Retry Is Not Infinite Loop
Retry eligible transient failures ≠ Escalate persistent failures
Parallel Is Not Shared Workspace
Parallel work needs isolation ≠ Shared scope creates conflicts
Artifact Is Not Chat History
Artifact supports review and audit ≠ Conversation alone may lack structure
Least Privilege Is Not No Tools
Grant capabilities required for task ≠ Deny unnecessary access
Human Control Is Not Blanket Approval
Gate materially risky actions ≠ Minimize low-value approvals
Last Minute
- 1.GH-600 is Agentic AI Developer
- 2.Exam title differs from credential
- 3.Six domain ranges match blueprint
- 4.Questions are not officially published
- 5.120 minutes is official exam time
- 6.700 is a scaled score
- 7.Define inputs, outputs, success criteria
- 8.Separate planning from execution
- 9.Validate plans before agent action
- 10.Scope tools by least privilege
- 11.Know MCP server, registry, allowlist
- 12.Record retries, rollbacks, escalations
- 13.Persist progress and decisions
- 14.Detect stale context and drift
- 15.Align signals with development intent
- 16.Classify each failure root cause
- 17.Isolate parallel agent execution
- 18.Document decisions and handoffs
- 19.Gate irreversible sensitive changes
- 20.Do not expect in-exam Learn
Buy on AmazonSame family resources
Explore More GitHub Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
More From This Family
Videos and articles for deeper review.