2 variants
B4.1
Attended and CI
A developer drives the assistant in the IDE, and bots review pull requests in CI. The org sets the guardrails through managed settings and GitHub controls.Data flow
- 1The developer drives the assistant and approves actions as it works.
- 2Org-managed settings, delivered through MDM, fix the permission mode, allowed commands and which MCP servers can load. Server-side settings are skipped once a custom gateway URL is set.
- 3Model calls go through the AI gateway, not personal keys. For PHI, check BAA scope first: Claude Code's HIPAA setup excludes the IDE extensions, and Anthropic's pages indicate LLM gateways aren't covered.
- 4The assistant edits the local repo and runs commands. No prod creds live on the machine. Dev secrets come from a password manager CLI such as 1Password, from a vault that holds only low-privilege credentials.
- 5Only toolshed MCP servers are available: the approved list behind the MCP gateway (see B3).
- 6Changes ship as pull requests through normal review.
- 7Session telemetry and EDR feed the SIEM.
- 8Your EDR's AI module and endpoint inventory tools find local MCP servers, IDE extensions, skills and rules files. MCP servers and extensions can be blocked; skills and rules files can only be detected.
- 9Pull requests also trigger CI bots that review code and suggest fixes. The job signs in to the model with job-scoped OIDC, fork PRs run with no secrets, and the bot can only comment or push to a bot branch. GitHub settings and CODEOWNERS, not the bot's prompt, keep it from approving or merging.
Attended and CI: build or buy
Buy + glueWhat you can buy for each box in the diagram, the open source option, and the part you still build yourself.
| Component | Buy | Open source | You build | Maturity |
|---|---|---|---|---|
| Developer approves actions | Policy in the assistant's admin settings to turn off bypass and auto-accept modes | · | Usage policy and short training | GA |
| IDE / CLI assistant | Claude Team Premium or Enterprise, GitHub Copilot Business or Enterprise, Cursor Teams or Enterprise | Cline, Continue, Aider | · | GA |
| Managed settings | Claude Code managed settings delivered by Intune, Jamf or Iru (formerly Kandji); Copilot MCP policy; Cursor Enterprise controls | Anthropic's MDM deployment templates | MDM profiles per OS, tested before rollout | GA |
| EDR + endpoint inventory | CrowdStrike Falcon Guardian (covers Claude Code through its hooks); SentinelOne AI Usage Control; StepSecurity Dev Machine Guard, Koi, Backslash | StepSecurity dev-machine-guard scanner (small project) | MDM script that finds MCP configs, extensions, skills and rules files and sends them to the SIEM | GA |
| Model access via gateway | Claude apps gateway (self-hosted, included with Claude Code) or your Track A gateway | LiteLLM | Gateway hosting and IdP sign-in setup | GA |
| Approved MCP tools | Claude Code managed MCP allowlist; Copilot MCP registry policy | Toolshed from B3 | Match servers by URL or command, not name | Preview |
| Local repo, no prod creds | 1Password Business or similar password manager CLI | Anthropic sandbox runtime (research preview) | Move prod credentials off laptops | GA |
| Session telemetry | Claude Code OpenTelemetry export; Elastic Claude Code integration; Copilot and Cursor audit logs on Enterprise tiers | OpenTelemetry Collector | Collector, parsing and EDR correlation | GA |
| CI bot (review comments, bot branch) | Copilot code review, Claude Code GitHub Action, Codex code review GitHub App installation tokens | anthropics/claude-code-action | Bot config that runs on trusted events only | GA |
| Fork PRs run without secrets | GitHub Actions defaults for pull request events | zizmor, actionlint | Audit workflows and remove pull_request_target jobs that check out PR code | GA |
| Job-scoped OIDC | GitHub OIDC to AWS, GCP or Azure; Anthropic Workload Identity Federation | · | One federation rule per repo or workflow | GA |
| Human review, protected main | GitHub rulesets with required reviews and CODEOWNERS | · | · | GA |
Rollout steps
| # | Step | Who | Effort |
|---|---|---|---|
| 1 | Pick one or two sanctioned assistants, buy team seats and block personal accounts | Security engineer | 2-3 days |
| 2 | Write the managed policy and deliver it through MDM, plus the admin console as a backup | Platform engineer | 1-2 weeks |
| 3 | Route model calls through the gateway and confirm policy still applies on each device | Platform engineer | 3-5 days |
| 4 | Roll out endpoint inventory for MCP servers, extensions, skills and rules files | Security engineer | 1 week |
| 5 | Move dev secrets to a password manager CLI and remove prod credentials from laptops | Platform engineer | 1-3 weeks |
| 6 | Build SIEM alerts for unapproved MCP servers, bypass attempts and settings changes | Security engineer | 1 week |
| 7 | Set Actions tokens to read-only, stop Actions from approving PRs and require approval for fork workflows | Platform engineer | 2-3 days |
| 8 | Scan workflows with zizmor, remove risky pull_request_target jobs and pin actions | Platform engineer | 2-5 days |
| 9 | Set up workload identity federation for model calls and delete stored model keys | Platform engineer | 2-3 days |
| 10 | Add rulesets requiring human and code owner review, with no bot self-merge | Platform engineer | 1-2 days |
What you still build
- MDM configuration profiles for macOS and Windows, tested per assistant
- Inventory pipeline from developer machines to the SIEM if you don't buy one
- Detection rules for skills and rules files, which no product blocks
- Removing prod credentials from developer laptops
- Workflow hardening pass across all repos
- Workload identity federation rules per repo
Gotchas
- Claude Code skips server-managed settings when it points at a custom base URL or a cloud provider, so a gateway setup needs MDM-delivered settings
- Server-managed settings are a client-side control. Anthropic says they aren't a security boundary on unmanaged devices
- Claude Code HIPAA coverage excludes the VS Code and JetBrains extensions, and per Anthropic's translated HIPAA pages, routing through an LLM gateway isn't eligible
- Skills and rules files can only be detected, not blocked. Only MCP servers and VS Code extensions can be blocked
- Copilot's registry-only MCP policy is in public preview, and Cursor's MCP controls need Enterprise
- Command logging is off by default and captures sensitive content when on
- The real fork risk is pull_request_target or workflow_run jobs that check out PR code. AI review bots tempt teams into this because they need a model key
- A leftover Anthropic API key in the environment silently overrides workload identity federation
- Enforce suggest-only with GitHub settings and CODEOWNERS, not the bot's prompt
B4.2
Autonomous fleet
Agents work tickets unattended in sandboxes. The merge gate is the control that matters most. Vendor-hosted agents are the fast path; self-hosting the fleet is 8 to 16 weeks of custom work.Data flow
- 1A developer assigns a ticket. The agent starts in a fresh sandbox that is destroyed when the task ends.
- 2Credentials come from OIDC and a GitHub App, scoped to one repo. GitHub App tokens last one hour and can be revoked early.
- 3Model calls go through the AI gateway for logging, DLP and budgets.
- 4Issues, dependencies and web content are treated as untrusted data.
- 5The agent can only open a pull request. Branch protection blocks direct pushes.
- 6CI runs tests, secret scanning and SCA. A human approves before merge and deploy.
- 7Only allowlisted MCP tools from the toolshed are available.
- 8Egress is limited to the gateway and registries behind a package firewall. Every command and file read is logged.
Autonomous fleet: build or buy
Buy + glueWhat you can buy for each box in the diagram, the open source option, and the part you still build yourself.
| Component | Buy | Open source | You build | Maturity |
|---|---|---|---|---|
| Ticket assignment | Copilot cloud agent, Cursor cloud agents, Claude Code on the web, OpenAI Codex | · | Ticket-to-sandbox orchestration if self-hosted | GA |
| Ephemeral sandbox | Vendor-hosted agent sandboxes; E2B, Daytona, GitHub Codespaces or Coder for self-hosted | Anthropic dev container with firewall, Anthropic sandbox runtime | Sandbox image, lifecycle and guaranteed teardown | GA |
| Per-task scoped credentials | Built into Copilot cloud agent; GitHub App installation tokens | actions/create-github-app-token | Token broker that mints one-repo tokens per task if self-hosted | GA |
| Egress allowlist | Copilot agent firewall, Codex internet access controls, Claude Code on the web network settings, Harden-Runner | Dev container firewall script, Squid or Envoy, sandbox runtime proxies | Egress proxy and allowlist ownership if self-hosted | GA |
| Branch protection | GitHub rulesets; Copilot pushes only to its own branch | · | · | GA |
| CI and merge gate | The Attended and CI variant's controls, plus GitHub Secret Protection and Code Security | gitleaks, TruffleHog, OSV-Scanner | Required checks on every agent PR | GA |
| Package firewall | Socket (Enterprise for self-hosted or custom registries), StepSecurity Secure Registry, JFrog Curation | Socket Firewall free tier, Verdaccio, devpi | Point sandbox package config at the proxy | GA |
| Untrusted content | No product removes prompt injection | · | Limit tools, treat issues and web content as data, review output | No product |
| Session audit | Copilot session logs, Claude Code telemetry and hooks, sandbox provider logs | OpenTelemetry Collector | Hook that logs every command and file read to the SIEM | Preview |
Rollout steps
| # | Step | Who | Effort |
|---|---|---|---|
| 1 | Pilot one vendor-hosted agent on 3 to 5 repos and review its firewall defaults | Platform engineer | 1 week |
| 2 | Add rulesets requiring code owner review and passing checks on agent PRs | Platform engineer | 2-3 days |
| 3 | Put a package firewall in front of registries and point the agent setup at it | Platform engineer | 1 week |
| 4 | Reuse the CI merge gate from the Attended and CI variant as required checks | Platform engineer | 1-2 days |
| 5 | Set limits on agent PR volume and size per developer | Engineering manager | Ongoing |
| 6 | Self-hosted only: build the token broker, sandbox image, egress proxy, orchestration and audit hooks | Platform engineer and security engineer | 8-16 weeks |
What you still build
- Per-task GitHub App token broker that checks the ticket and repo before minting
- Egress proxy and a named owner for its allowlist
- Ticket-to-sandbox orchestration with guaranteed teardown
- Audit hooks that send every command and file read to the SIEM
- PR volume policy so reviewers aren't swamped
Gotchas
- Reviewer time on bot PRs is the real limit and a hidden cost that can exceed tool spend
- Usage-billed agent work is the largest cost and swings with task volume and model choice
- GitHub App installation tokens always last 1 hour. You can narrow repos and permissions but not shorten them
- Anthropic's dev container doesn't stop a malicious project from exfiltrating what's inside, so use a persistent container only for trusted repos
- Users report Claude Code on the web's trusted allowlist drifting from the hosts tools actually call
- OpenAI now labels Codex Cloud as legacy in its docs
- Self-hosting the fleet is mostly custom work and takes 8 to 16 weeks. Vendor-hosted agents are the fast path.
Common use cases
- Pair programming in the IDE
- PR review and test generation in CI
- Dependency upgrades and migrations
- Backlog tickets worked unattended
Key risks
- Injection via issues, READMEs and dependencies
- Malicious MCP servers, extensions, skills and rules files
- Secrets exposed to fork or untrusted CI runs
- Reviewer time on bot PRs, which can cost more than the tools
- Token scope creep across repos
Fast path
- SIMPLIFYPersistent dev container for trusted repos only, with no prod creds and allowlisted egress
- KEEPShort-lived scoped tokens (GitHub App, OIDC)
- KEEPBranch protection and human review
- KEEPNo secrets on fork or untrusted runs
- SIMPLIFYSession and job logs to bucket first