diff --git a/__tests__/hooks/handler.test.ts b/__tests__/hooks/handler.test.ts
index b9f80f64..53fa5403 100644
--- a/__tests__/hooks/handler.test.ts
+++ b/__tests__/hooks/handler.test.ts
@@ -443,6 +443,8 @@ describe("hooks/handler", () => {
         ["rg", "Grep"],
         ["ls", "LS"],
         ["web_fetch", "WebFetch"],
+        ["task", "Task"],
+        ["web_search", "WebSearch"],
       ];
       for (const [raw, canonical] of cases) {
         vi.mocked(evaluatePolicies).mockResolvedValueOnce({
diff --git a/src/hooks/types.ts b/src/hooks/types.ts
index fd2ff7f3..8e3bf63c 100644
--- a/src/hooks/types.ts
+++ b/src/hooks/types.ts
@@ -275,6 +275,12 @@ export const COPILOT_TOOL_MAP: Record<string, string> = {
   rg: "Grep",
   ls: "LS",
   web_fetch: "WebFetch",
+  // Documented Copilot tools that launch subagents / web search. Without these
+  // entries a policy matching `toolName === "Task"` (or `"WebSearch"`)
+  // silently never fires on Copilot — the worst failure mode for a guardrail.
+  // `ask_user` is intentionally unmapped: it has no filesystem or shell reach.
+  task: "Task",
+  web_search: "WebSearch",
 };
 
 /**