AI coding agents in regulated industries: residency, audit and approvals

Regulated teams in financial services, healthcare and the public sector can use AI coding agents, provided they can answer four questions: where code and prompts go, who approved each action, what record exists afterwards, and which models are allowed. Agent settings answer part of that. Local scanning, platform policies and model controls answer the rest.

You do not have to switch away from the assistant your developers already like to get there. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. Teams that prefer the chat window can connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from there, under limits an administrator sets.

This guide is written for engineering leaders, security teams and the risk and compliance people who sit next to them. It stays general and it is not legal advice. Your own regulators, auditors and counsel decide what your obligations are. What follows is how to build a setup you can explain to them.

What regulators tend to ask about AI tools

Most regulators have not written rules specific to coding agents. They apply the rules they already have, and they expect firms to show that a new tool fits inside them.

FINRA's Regulatory Notice 24-09 on generative AI is a clear example from US financial services. It says it does not create new legal or regulatory requirements, describes FINRA's rules as intended to be technology neutral, and notes that they apply whether a firm builds a generative AI tool or uses one from a third party. The practical reading is simple: the supervision, communications and vendor obligations you already have still apply when an agent writes the code.

In US healthcare, the HIPAA Security Rule's technical safeguards include audit controls, described as mechanisms "that record and examine activity in information systems" containing electronic protected health information, alongside access control and person or entity authentication. An agent that can read a repository holding test fixtures with patient data, or a script that queries a clinical database, is part of that picture.

For the public sector and for anyone who wants a common vocabulary, NIST publishes the AI Risk Management Framework. NIST describes it as intended for voluntary use and organises it around Govern, Map, Measure and Manage. A Generative AI Profile (NIST AI 600-1) followed in July 2024. NIST SP 800-218A, also from July 2024, extends the Secure Software Development Framework with practices specific to AI model development. Neither tells you which agent to buy. Both give you language that auditors recognise.

Across all three sectors the same themes come up: know where data goes, control who can do what, keep records, and be able to explain your choices. The next section turns those themes into four questions.

The four questions every regulated team has to answer

1. Where do code and prompts go?

When a coding agent uses a hosted model, prompts, the code it reads into context and the model's outputs travel to the model provider. Claude Code's data usage page states that it sends all user prompts and model outputs over the network, encrypted in transit with TLS 1.2 or later.

The useful detail for regulated teams is that the destination can often be chosen. Claude Code's documentation lists the Anthropic API, Amazon Bedrock, Google Cloud's Agent Platform and Microsoft Foundry as providers, each with its own encryption at rest. For Microsoft Foundry deployments hosted on Azure, it says prompts and completions remain within Azure. On retention, it describes a standard 30-day period for commercial accounts, and zero data retention available to qualified Claude for Enterprise accounts on a per-organisation basis. Under commercial terms, Anthropic says it does not train generative models on code or prompts sent to Claude Code unless the customer opts in.

OpenAI's Codex admin guide says data residency and inference residency cover eligible content and supported configurations. It also says that local computer access with Work Cloud does not provide strict zero data retention, and tells organisations that require it not to enable that feature.

The source code itself is a separate question from the conversation. Scanning does not need to send source anywhere. With the Safeguard local runner, platform scan jobs run on your machine and only SBOMs and findings are uploaded.

2. What record exists afterwards?

An auditor will ask what happened, when and on whose authority. For coding agents that means a record of tool calls, approvals and changes.

The vendors offer pieces of this. Claude Code's security page says all operations in its cloud sessions are logged for compliance and audit purposes, and it supports monitoring through OpenTelemetry metrics. Codex's admin guide points administrators to the Compliance API for audit and investigation records.

Git history covers the code itself. What tends to be missing is the record of what an assistant did in shared systems: which tools it called, against which data, and what was refused. That is where MCP audit trails help (more below).

3. Who approved each action?

Separation of duties does not disappear because a model wrote the change. Two kinds of approval matter.

• Action approvals inside the session. Should the agent be allowed to run this command or edit this file? Every serious agent has a setting for this.
• Change approvals outside the session. Should this change reach production? That is your pull request review and your release gate, and it should not depend on which agent the developer used.

Administrators also need a way to enforce the first kind centrally. Claude Code supports managed settings that users cannot override, including switches to disable bypass and auto modes. Codex supports a requirements.toml file delivered through a managed channel that can constrain which permission profiles are allowed.

4. Which models are allowed?

Many regulated firms keep an approved model list. Some forbid language models entirely for certain systems. A good setup lets an administrator decide which model families people can use, and lets a team route specific jobs to a model on its own provider account.

This demo shows how that works in Safeguard. You choose the model for each conversation. Zero (z20) answers with no language model at all, turning the question into a platform query. Griffin, Eagle and Lion are Safeguard's own models. A tenant admin chooses which model families people may use, and you can bring your own model on your own provider account and route jobs such as chat or summaries to it.

Click through it at your own pace, or open it full screen.

How the main tools handle these controls

The table below collects facts from each vendor's own documentation, fetched on 21 October 2026. It is a starting point for your own review, not a ranking. Plans and features change, so check the current docs before you rely on any row.

Sector notes in general terms

Financial services

Expect questions about vendor risk, supervision and data leaving the firm. The local runner pattern is often the quickest way through a security review: the scan runs inside your environment and only results leave. For the assistant itself, document which model provider each team uses and on what terms, and keep the approval mode for production-adjacent repositories on Ask.

Change management teams will want to see that an agent-written change goes through the same pull request review and release gate as any other. A platform gate that blocks a build on a critical, reachable vulnerability or a disallowed licence gives them something concrete to point at.

Healthcare

The main concern is protected health information reaching places it should not. Keep real patient data out of repositories and test fixtures in the first place. Then block agents from reading any files that might still hold it (Claude Code, for example, supports deny rules such as Read(./secrets/**)), and decide which repositories may use a hosted model at all. For systems where any language model is off the table, Zero mode in Safeguard answers questions as platform queries with no model involved.

Public sector

Public sector teams usually care about where infrastructure sits, who operates it and what can be shown to an assessor. Use NIST's AI RMF vocabulary to describe your controls. Keep the scanning local, choose model providers that match your hosting requirements, and limit what assistants can reach in shared systems with MCP tool controls. When a team wants to evaluate before installing anything on managed devices, the Safeguard download page lists a cloud sandbox tenant against a seeded demo repo, free for seven days with no card.

Do the work properly with the Safeguard CLI

The Safeguard CLI scans code, container images and SBOMs on your own machine, sends only the results to the platform, and includes an assistant that can fix what it finds. It writes code as well as scanning it, and it knows your vulnerabilities while it works.

Install

One static binary, with no Node, Python or JVM required. It runs on macOS, Linux and Windows, on x86_64 or arm64 (Windows ships x86_64 only).

# macOS and Linux
curl -fsSL https://cli.safeguard.sh/install | bash

# Windows, in PowerShell
irm https://cli.safeguard.sh/install.ps1 | iex

First session

safeguard
/login
/scan .

Running safeguard with no arguments opens the interactive terminal. /login signs in through the browser, and /scan . scans the current folder. Then ask in plain language, such as "how many critical vulns do we have". @ attaches a file from the folder you started in, and /resume picks up the last session there.

Writing and fixing code

The assistant has tools for your local files and for your Safeguard data and picks whichever the question needs. With your approval it can find and read files, edit code and run commands, so "fix the lodash CVE in this repo" becomes a diff you review rather than a ticket that waits. For the wider picture of using it as a day-to-day terminal assistant, see the Safeguard CLI as an AI assistant on your machine.

Use your Claude, ChatGPT or Codex plan

Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. /model shows or switches the model; see the CLI docs or /model for connecting one. For regulated work, record which model each team is approved to use, because conversation content goes to that provider under its terms.

Approvals

Tools that change things ask before they act. /permissions sets the mode: Ask prompts before every action, Auto approves known actions and asks for anything new (the default), and Yolo approves everything. A sensible regulated baseline is Ask on any repository near production data, Auto elsewhere, and Yolo only in disposable environments.

Scans and CI

safeguard scan --dir .
safeguard scan --image myregistry.azurecr.io/myapp:v1
safeguard validate sbom.json
safeguard exec "summarise the critical findings in this repository"

safeguard scan builds an SBOM and matches it against vulnerability databases, writing JSON files such as vuln.json and license.json under ./output. safeguard validate checks CycloneDX, SPDX and VEX documents, which helps when a customer or regulator asks for your SBOM. safeguard exec runs one non-interactive assistant turn for CI. Policies and gates are evaluated in the platform, not by the CLI. The pattern of scanning whatever an agent changed before merge is covered in detail in checking coding agent changes with the Safeguard CLI.

Platform controls that hold for every team

Policies and gates. Write a rule once and enforce it at build, CI or release. The rule applies to every pull request whichever agent, or person, wrote it. That is the control your change management board will ask about.

Reachability analysis. It shows whether vulnerable code is actually called by your application, which keeps reviewers focused on findings that matter instead of a long list of theoretical ones.

Autonomous remediation. Safeguard can open tested fix pull requests. It ships off by default with each category on manual, which suits teams that need to show every change was a deliberate decision. When enabled, the pull requests still go through your normal review.

MCP Guardrail. Safeguard's MCP server gates tools per tenant. A new workspace starts with six read-only tools, an administrator enables others, and tools a tenant cannot use are neither listed nor callable. For MCP traffic more broadly, Guard policies match on the MCP method, tool name or agent and allow, deny or monitor each call. Every evaluated request lands in an append-only audit trail with the rule that matched, which answers the "what did the assistant do in shared systems" question from earlier.

This demo shows ChatGPT connected to the Safeguard MCP server with OAuth, with you choosing which tools ChatGPT can use. Claude works the same way.

Click through it at your own pace, or open it full screen.

One platform across devices. People start in the terminal, continue in the desktop app (3.2.2 for Windows, macOS and Linux) and check findings on the iOS or Android app. On the desktop, note the download page's guidance for Windows: the installer is not yet code-signed, so verify the SHA-256 first before choosing More info and Run anyway. The macOS build is signed and notarized. For managed Android fleets, the page offers a direct APK with a SHA-256 to check alongside Google Play.

A step by step rollout

1. Write down your four answers. Where code and prompts go, what gets recorded, who approves, which models. One page is enough.
2. Classify repositories. Mark the ones near regulated data. They get stricter settings.
3. Pick approved models per class. Use your provider's enterprise terms, and in Safeguard have a tenant admin set the allowed model families.
4. Set approval baselines centrally. Managed settings for each agent in use, and Ask mode in the Safeguard CLI for sensitive repositories.
5. Block sensitive reads. Deny rules for secrets folders, environment files and fixtures.
6. Install the CLI and baseline scan. Run safeguard scan --dir . on each repository before agents change it.
7. Add CI scans and platform gates. Start with a short rule list you can defend to an auditor.
8. Limit MCP tools. Keep the read-only default and enable tools one at a time with a written reason.
9. Collect evidence monthly. Gate results, MCP audit entries and vendor audit exports, filed where your auditors expect them.

Common mistakes

Treating vendor settings as the whole policy. Agent settings are local and vary by tool. You also need controls that sit outside every agent.

Mixing up data residency and source residency. Choosing a model region does not tell you where your scanner sends source. Ask both questions.

Leaving permissive modes on sensitive repositories. Yolo, bypass and full-access modes belong in disposable environments.

Turning on autonomous remediation without a review path. Keep fix pull requests in the normal review flow so the approval record exists.

Claiming more than you can show. Write down only controls you can produce evidence for. Ask every vendor, including Safeguard, for current attestation status rather than assuming it.

FAQ

Can regulated firms use AI coding agents at all?

Generally yes, within existing rules. FINRA's notice, for example, describes its rules as technology neutral. The work is showing that the tool fits your existing obligations for data, supervision and records. Check with your own regulators and counsel.

Can we keep our Claude, ChatGPT or Codex plan and still use Safeguard?

Yes. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already use.

Does our source code leave our environment when we scan?

When the local runner runs platform scan jobs, source stays on your machine and only SBOMs and findings are uploaded. Conversations with a hosted model go to that model's provider under its terms.

Can we use Safeguard with no language model at all?

Yes. In the model picker, Zero (z20) answers with no language model by turning the question into a platform query.

Who decides which models people may use?

A tenant admin chooses which model families are allowed. Teams can also bring their own model on their own provider account and route jobs such as chat or summaries to it.

How do we show an auditor what an assistant did?

Combine git history and pull request reviews for code, platform gate results for releases, the vendor's audit exports for agent sessions, and Safeguard's append-only MCP audit trail for calls into shared systems.

Does the Safeguard CLI act without approval?

Actions that change things ask first, according to /permissions. Ask prompts every time, Auto (the default) asks for anything new, and Yolo approves everything.

Can we evaluate without installing software?

Yes. The download page lists a cloud sandbox tenant against a seeded demo repo, free for seven days with no card, and a Cloud CLI on Safeguard's infrastructure.

Try it yourself

This demo is the install and start walkthrough: set up the runner on your own machine, pick the platform, start it, approve it with its device code, then use the same CLI to scan from the terminal.

Click through it at your own pace, or open it full screen.

When you are ready, download Safeguard and read the CLI docs. Keep the plan you already pay for, keep source on your machine, and let the platform hold the rules your auditors will ask about.

Quick check

Sources

• Safeguard CLI overview
• Safeguard CLI interactive terminal
• Safeguard CLI usage guide
• Safeguard downloads
• How MCP Guardrail works
• Claude Code data usage
• Claude Code security
• Claude Code permissions
• Codex enterprise admin setup
• Codex sandboxing
• Codex Security
• FINRA Regulatory Notice 24-09
• 45 CFR 164.312, technical safeguards
• NIST AI Risk Management Framework
• NIST SP 800-218A

Last reviewed: 21 October 2026.