AI Coding Agent Governance: Model Policies, Budgets, Audit

Govern AI coding agents in five layers: identity (SSO and SCIM), a model allow-list kept as code, budget caps per user and group, sandboxed execution with network rules, and review gates plus audit logs. As of November 2026, Copilot, Claude Code, Cursor, Codex and Devin all expose most of these controls. Most still ship with the strictest settings turned off.

Updated 13 November 2026. A year ago, "AI coding governance" mostly meant picking a vendor with a SOC 2 report. Now a typical engineering org runs two or three agents. Each has its own model list, which changes monthly, its own usage-based bill and its own way of opening pull requests. This guide maps the controls that exist today, from each vendor's docs and changelogs, onto a policy you can enforce. For tool selection, see our Cursor vs Claude Code vs Codex vs Devin comparison. For general AI agent governance, see AI agent governance.

What does governing AI coding agents actually involve?

It means answering five questions with settings, not slide decks. Who can use which agent? Which models may it call? How much may it spend? What can it touch while it runs? Who approves what it produces? Then you keep evidence of all five. The rest of this post takes the layers one at a time.

Sources are linked in each section below. "Enterprise" means the vendor's top plan. Several controls are missing from lower plans.

How do you control which AI models developers can use?

Keep one reviewed allow-list in version control and push it to every tool through its admin API or managed settings. Since 19 October 2026, GitHub supports this directly. Its Copilot model-policy endpoints (GET and PATCH) are GA for enterprises, enterprise teams, agent apps and organizations.

Why this needs to be code, not a one-time setting:

• Models churn monthly. GitHub deprecated 10 Copilot models in October and 3 more go on 16 November. Replacements may need to be enabled by an admin before developers see them.
• Defaults differ per model. Claude Fable 5.2 arrived in Copilot on 9 November with its policy off by default. Gemini 4 Carbon arrived on 10 November and is enabled automatically if your global default is on. Without a reviewed list, what your developers can use depends on the vendor's default.
• Models differ on data handling. Fable 5.2 retains prompts and outputs for safety classifiers inside Copilot. Your allow-list is also a data-retention decision.

In Claude Code, the self-hosted Claude apps gateway maps IdP groups to model allow-lists and rejects requests for models a group was not granted, on the server side. Codex lets Enterprise admins enable models one by one. GPT-6.1 Sol stays off until an admin turns it on. Devin and Cursor Enterprise both offer model restrictions in admin settings. For how to move between models safely once the list changes, see our LLM model migration guide.

How do you cap AI coding agent spend?

Set three limits on every platform: per user, per group or team, and per organization. Then pull daily usage into your own dashboard. Every major vendor now supports at least two of the three, and most added them in the last few months.

• GitHub Copilot: usage is metered in AI Credits (1 credit = $0.01). Agent mode, code review and the cloud agent consume credits, while inline completions do not. Paid users can set a dollar budget with alerts at 75%, 90% and 100%. On Business and Enterprise, admins set limits and decide whether extra paid usage is allowed (Copilot plans).
• Claude: Enterprise supports limits at organization, group and user level. Claude Code 2.1.316 (31 October) added pooled group budgets, one monthly budget shared by a group. 2.1.317 added a cost report to the gateway admin API, by developer, day or IdP group.
• Devin: the 30 October release added a budget hierarchy for user and organization spend, with delegated sub-budget management. A daily session-consumption API followed on 9 November (Devin release notes).
• Cursor: Enterprise lists granular spend controls and group-level spend limits. Third-party models are billed at API list price on top of the plan.
• Codex: Business and Enterprise buy workspace credits. Enterprise with flexible pricing has no fixed rate limits, so usage scales with credits and needs a cap.

Why per-user caps matter: agent usage is highly skewed. A few developers running long autonomous sessions can outspend the rest of the team. Our analysis of the cost to run an AI product explains the pattern.

What identity controls should AI coding agents support?

Require SSO for every agent, SCIM for automatic deprovisioning, and no long-lived personal tokens without approval. All five vendors offer SAML or OIDC SSO on business plans. SCIM is usually Enterprise-only, so price that in.

Two recent changes are worth adopting. Devin now lets admins verify their domain with a DNS record and manage OIDC or SAML connections themselves. Enterprises with no token policy now default to "approval-required" for personal access tokens, and admins can sign a user out of every Devin surface at once. On the Claude apps gateway, deprovisioned users lose access within the session lifetime, one hour by default. Check that the same holds for every tool you run. An ex-employee's agent session is the gap auditors find first.

What audit logs do AI coding agents provide?

Enough to reconstruct who asked an agent to do what, with which model, and what it changed, but only if you export them. The logs live in different places for each vendor. Plan to pull them into your SIEM rather than reading them in each admin console.

• GitHub: "Session logs and audit log events are available to administrators" for the Copilot cloud agent. Commits are authored by Copilot, with the requesting developer as co-author (GitHub docs).
• Claude Code: the gateway writes single-line JSON audit events and sends OTLP metrics with token counts, model, user identity and latency to your collector. Per the docs, it sends none of these to Anthropic. Claude Enterprise adds audit logs.
• Codex: Enterprise exposes audit logs and usage monitoring through the Compliance API.
• Cursor and Devin: Cursor Enterprise lists audit logs and service accounts. Devin provides usage data through its consumption API.

Log the prompt source too. A task triggered from an issue, a Slack message or a schedule is an input path an attacker can use.

How should you handle data retention with AI coding agents?

Decide per model, not per vendor, because retention now differs between models from the same vendor. Anthropic's Fable 5.2 has 30-day retention for safety monitoring unless an eligible enterprise adds Enterprise Frontier Safeguards. Most other Claude models in Copilot stay under zero retention.

Check four things for each tool: whether prompts and code are retained and for how long; whether they are used for training; where they are processed (data residency); and who holds the keys. Cursor offers Privacy Mode, which keeps code data out of training, plus custom chat retention on Teams. Codex Enterprise has retention and residency controls plus EKM. Devin offers a customer-dedicated single-tenant VPC, with customer-managed keys under Enterprise Assured. If you handle health or payment data, read our guide to LLM providers that sign BAAs before any of this.

How do you add approval gates to pull requests opened by AI agents?

Use the controls you already trust for humans, and close the gaps agents create. Protect branches, require CODEOWNERS, block self-approval by whoever asked the agent, hold CI workflows until a human approves, and deny tool calls rather than prompting in unattended runs.

• Copilot cloud agent pushes only to its own copilot/ branch. It prevents the requester from approving the PR, and by default does not trigger Actions workflows until someone with write access approves them.
• Claude Code added permissions.denyInsteadOfPrompting on 6 November, so unattended runs fail closed. blockWritesOutsideWorkingDirectories (30 October) keeps edits inside the repo.
• Devin requires admin approval for personal access tokens by default and added an "Ask before loading external content" session option on 11 November.
• Everywhere: treat AGENTS.md, CLAUDE.md, skills and MCP configs as code that changes agent behaviour. Require owner review. An October 2026 study showed that poisoned memory files can steer agents. Details are in our AI coding agent security benchmarks post.

What does a 90-day governance rollout look like?

Days 1–30: inventory and identity. Days 31–60: policy as code and budgets. Days 61–90: execution controls, review gates and audit export. Start with whichever agents already run in production. Shadow usage is the real risk, not the pilot.

1. Inventory. Which agents, plans, seats and API keys exist? Which repos do they reach? Which models are enabled? Turn off anything nobody owns.
2. Identity. SSO everywhere, SCIM where available, token approval on, and a tested offboarding path.
3. Policy as code. One allow-list repo, synced by API to Copilot and through managed settings to Claude Code, with a CI job that flags drift. Review it whenever a vendor announces a deprecation.
4. Budgets. Set user, group and org caps on every platform, with daily usage exported to your data warehouse.
5. Execution and review. Sandbox defaults, network allow-lists, no auto-approve with network access, branch protection, CODEOWNERS on agent instruction files, and audit logs flowing to your SIEM.

The monthly vendor changes we track in the November 2026 AI coding agent update are your trigger for step 3.

How BeevR builds this

BeevR is a senior, founder-led software and AI studio in Hanoi. We build AI agents for regulated industries, including healthcare, where we sign a BAA as a business associate and can run models inside the client's own AWS account. Our open-source Kite framework treats the model as an untrusted component behind deterministic checks. For engineering organisations rolling out coding agents, we can deliver the 90-day plan above as fixed-scope phases, priced from $10K per phase. That covers allow-lists as code, budget and usage export, sandbox and review gates, and audit pipelines. You get a working demo every Friday and own everything we build from day one.

See how we approach AI agent development, or book a 30-minute call to map your current agent setup.