Guide
Governance for AI coding agents
Governing AI coding agents means deciding what tools like Claude Code, GitHub Copilot and Cursor may run, read and send, and being able to prove what they did. It takes controls in two places: settings on each developer's machine, and a gateway that sees every model and tool call with the developer's identity.
The risks, and which layer covers each
Machine settings stop an agent from running or reading something on one laptop. A gateway sees what leaves it. Most teams need both, because each covers risks the other can't.
| Risk | What happens | On the machine | At the gateway |
|---|---|---|---|
| Destructive commands | The agent runs rm -rf, git reset --hard or a force push in the wrong directory. | Deny rules, PreToolUse hooks | Tool-call policy and human approval for high-risk actions |
| Reading secrets | The agent opens .env files or credentials and sends their contents to the model. | Read deny rules for secret paths | Request scanning before data leaves |
| Unapproved MCP servers | A developer adds a server that exposes tools nobody reviewed. | Managed MCP allowlist | Inventory of servers actually called, per-tool policy |
| Sensitive data in prompts | Customer PII or national IDs are pasted into a prompt or pulled in from a file. | Not covered | PII redacted or held for approval |
| Runaway spend | Long sessions and agent loops burn tokens with no per-person limit. | Not covered | Per-user and per-session budgets |
| Shared API keys | One key for the whole team: no attribution, and revoking it stops everyone. | Not covered | Per-developer tokens tied to your IdP |
| No record of what happened | After an incident nobody can say which agent ran what, for whom. | Local transcripts only | Every call logged with identity and decision |
Machine settings and the gateway
In Claude Code, permission rules are evaluated deny first, then ask, then allow, and managed settings sit above user and project settings, so developers can't override them. Those rules match the command text the agent writes, not the program, so /bin/rm or sh -c slips past a rule for rm. A gateway doesn't depend on that text: it decides on each model and tool call, with the developer's identity attached.
Guides in this series
Step-by-step guides for each control, checked against the tools' own documentation. New guides appear here as they're published.
Published guides
- How to block destructive commands in Claude CodeOctober 24, 2026
- How to route Claude Code through an AI gatewayOctober 25, 2026
- Claude Code managed settings for enterprisesOctober 26, 2026
Coming next
- How to stop Claude Code from reading secrets and .env files
- How to track AI coding tool cost per developer
- How to stop PII and national IDs from reaching LLMs
- How to audit what your AI coding agent did
- How to cap AI coding agent spend per developer
- AI coding agent security risks (and the controls for each)
- How to run Claude Code in a sandbox
- Governing Claude Code, Cursor and Copilot with one policy
Governing coding agents with AIControls
Run AIControls in your own cluster to cap AI spend, block risky calls and audit every request from Claude Code, Copilot, Cursor and agents.
- Identity on every call
Developer, workload, or delegated agent — verified via your IdP.
- Inline budgets
Spend attributed to team, user, and model as it happens; budgets enforced before overrun.
- Request & Response Scanning + PII Redaction
PII redacted in both directions and a human gated on anything high-risk.
- MCP governance
Per-tool and per-datasource policy, argument validation, discovery scoped to identity.
Frequently asked questions
What counts as an AI coding agent?
A tool that writes and runs code for a developer with some autonomy: it reads files, runs shell commands, calls MCP tools and edits the repository. Claude Code, GitHub Copilot and Cursor are the common ones. The autonomy is what makes governance necessary, because the agent acts with the developer's access.
Are Claude Code permission settings enough?
They are the first layer, not the whole answer. Deny rules match the command text the agent writes, and the Claude Code permissions docs say plainly that a Bash rule isn't a security boundary around the program. Managed settings stop developers removing the rules. Spend, identity and data leaving the machine need a gateway.
Should every developer have their own API key?
Yes. Per-developer tokens tie every call to a person, so spend can be attributed and limited per user, and one key can be revoked without stopping the team. A shared key hides who did what and turns every revocation into an outage. Issuing tokens through your identity provider keeps them in step with joiners and leavers.
How do I see what an AI coding agent did?
Local transcripts live on each developer's machine and can be deleted. For a record the security team can rely on, route agent traffic through a gateway that logs each model and tool call with the developer's identity, the arguments and the policy decision, then keep those logs centrally.