AI Coding Assistants for Enterprises Compared: Admin, SSO and Models

For enterprise buyers, GitHub Copilot, Claude Code, OpenAI Codex, Kiro, Cursor and Gemini Code Assist differ most on five things: how people sign in, what admins can lock down, which models are allowed, where the agent runs, and when it must ask first. This comparison uses only each vendor's own documentation.

Whichever assistant you standardise on, Safeguard sits next to it rather than in its place. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server, so people use Safeguard from the chat they already have.

What enterprise buyers should compare

Feature lists for coding assistants look alike. The differences that matter to a platform or security team sit in the admin documentation, and they fall into five questions.

Identity and SSO. Can people only sign in through your identity provider, and can you stop them from signing in with a personal account on a work machine? Look for SAML or OIDC support, SCIM provisioning, and a way to force sign-in to your organization.

Admin policy. What can an administrator switch off centrally, and can a developer override it locally? The useful controls are feature toggles, MCP server allowlists, web access toggles, and settings pushed through device management that user config cannot override.

Model choice. Which model families can people pick, and can an admin restrict that list? Some teams also need inference to stay in their own cloud account, which is a question about providers as much as models.

Where code runs. A local agent runs on the developer's machine and sends prompts and the files it reads to the model provider. A cloud agent runs in a hosted environment with a clone of your repository. Many products now do both, often with separate admin switches.

Approvals. When does the agent stop and ask? Look at the default mode, whether admins can disable the most permissive mode, and what happens in CI where nobody is there to click Allow.

Audit trails and data use for training are the sixth question. We note them below only where a vendor page we read stated them.

The assistants compared

The table summarises what each vendor's documentation says. Plans and features change often, so treat it as a starting point and confirm against the linked pages before you sign.

GitHub Copilot

GitHub's plans page lists Business, with "centralized management and Copilot policy control," and Enterprise, for companies on GitHub Enterprise Cloud. Identity comes from GitHub Enterprise Cloud: SAML SSO on top of personal accounts, or Enterprise Managed Users where your identity provider provisions accounts through SCIM, and OIDC with Entra ID.

Policies live on the AI controls page. Enterprise owners can set a policy for the whole enterprise or let organization owners decide, with sections for agents, Copilot features and clients, models, and MCP. The supported models page lists providers including OpenAI, Anthropic, Google and xAI, and says an administrator "must still enable each model before users can access it." One default to check: suggestions matching public code is "set to Allowed by default for Copilot Business users."

The cloud agent runs in an ephemeral cloud environment. GitHub's risks page says only users with write access can trigger it, it pushes to a single branch, its workflows do not run until its code is reviewed, internet access is restricted by a firewall, and it "cannot approve or merge a pull request."

Claude Code

Anthropic's authentication docs recommend Claude for Teams or Enterprise for organizations. Teams includes admin tools, SSO and server-managed settings; Enterprise adds domain capture, role-based permissions and the compliance API. Teams can also use the Claude Console with SSO and a Claude Code role that can only create Claude Code API keys, or route through Amazon Bedrock, Google Cloud or Microsoft Foundry.

The admin story is managed settings. The docs say "no other level, including command line arguments, can override a managed permission rule." From managed settings you can force sign-in to your organization with forceLoginMethod and forceLoginOrgUUID, restrict providers with allowedProviders, limit the model picker with availableModels, and switch off the most permissive modes with disableBypassPermissionsMode and disableAutoMode.

Claude Code runs on the developer's machine in the terminal, IDE and desktop app, and on Anthropic's side for web sessions. Its permission modes run from Manual, which "prompts for permission on first use of each tool," through acceptEdits, plan, auto and dontAsk to bypassPermissions. The licence file reads "All rights reserved" under Anthropic's Commercial Terms.

OpenAI Codex

Codex is included in ChatGPT Business, Edu and Enterprise, alongside the individual plans. In an Enterprise workspace, local and cloud access are separate switches, and the admin docs say "Codex Cloud is off by default for Enterprise workspaces." For identity, the authentication docs let admins set forced_login_method and forced_chatgpt_workspace_id; if credentials do not match, "Codex logs the user out and exits." Credentials are cached in ~/.codex/auth.json or the OS credential store.

Local runs are constrained by managed requirements delivered through a cloud, device or system channel, kept separate from workspace roles. The default sandbox has no network access and limits writes to the active workspace, with .git read-only. Codex cloud "uses hosted environments and connected source repositories," and the docs note that cloud environments "don't inherit local device policy, MDM settings, or local network access." For audit, OpenAI points to the Compliance API. The CLI is Apache 2.0.

Kiro

Kiro is AWS's successor to the Amazon Q Developer IDE plugins, which AWS stops supporting on 30 April 2027. Enterprise users are subscribed through the AWS console and sign in with IAM Identity Center, Okta or Microsoft Entra ID. Data is stored in the Region where your Kiro profile is created.

Kiro's governance page gives admins three levers: turn MCP off or allow only vetted servers from an MCP registry, restrict users to an approved model list with a default model, and disable the web_search and web_fetch tools. API key generation is disabled by default, and Cloud Sessions are off by default for Identity Center organizations. Without a permissions file, Kiro reads workspace files silently and prompts for nearly everything else, and untrusted workspaces ask before every shell command and MCP call.

Cursor

Cursor's enterprise page lists SSO on Teams and Enterprise, SCIM provisioning on Enterprise, and an org-wide privacy mode on Enterprise, described as "No training on your data by Cursor or other AI providers." Enterprise admins can restrict models, enforce Agent Sandbox Mode, set auto-run, browser and network controls, block repositories, and restrict who can use the CLI, create Cloud Agents or bring their own keys. Audit logs on Enterprise track authentication, user management and admin actions, with SIEM streaming. The page did not say where Cloud Agents execute.

Gemini Code Assist

Google's overview describes Standard and Enterprise editions, with Enterprise adding customization on your private code from GitHub, GitLab and Bitbucket. It lists VPC Service Controls, Private Google Access and IP indemnification. The same page states: "New Gemini Code Assist subscriptions are no longer available for purchase." If you are evaluating it now, ask Google what replaces it for new customers.

Amazon Q Developer Pro

Teams still on Q Developer Pro have an admin dashboard for user and policy management, IAM Identity Center support, and IP indemnity. AWS says Pro content is not used for service improvement, and for Identity Center users, IDE and command line content is stored in the Region of the Q Developer profile. Plan your move before April 2027.

Rolling out an assistant: a step-by-step evaluation

A pilot should test the controls, not only the code suggestions. This sequence works for any of the products above.

Step 1: Wire identity first

Connect the product to your identity provider before anyone installs anything, then block personal sign-ins on work machines. For Claude Code, that is a managed settings file pushed by your device management tool:

{
  "forceLoginMethod": "claudeai",
  "forceLoginOrgUUID": ["xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"],
  "allowedProviders": ["anthropic", "bedrock"],
  "availableModels": ["opus", "sonnet"],
  "permissions": {
    "disableBypassPermissionsMode": "disable",
    "deny": ["Read(./.env)", "Read(./secrets/**)"]
  }
}

For Codex, the authentication docs name these settings for managed environments:

forced_login_method = "chatgpt"
forced_chatgpt_workspace_id = "your-workspace-id"
cli_auth_credentials_store = "keyring"

For Copilot and Kiro, the equivalent work happens in GitHub Enterprise Cloud and in IAM Identity Center or your connected IdP.

Step 2: Decide local, cloud or both

Cloud agents are convenient and change your threat model, because they hold a repository clone and a token on someone else's infrastructure. Codex cloud is off by default for Enterprise and Kiro Cloud Sessions are off by default for Identity Center orgs. Turn them on deliberately, for a named group, after the local pilot.

Step 3: Set model policy

Write down which model families are approved and where inference may run. Copilot needs each model enabled; Kiro takes an approved list; Claude Code takes availableModels and allowedProviders. If inference must stay in your cloud account, Claude Code's Bedrock, Google Cloud and Foundry routes are documented in its authentication guide.

Step 4: Lock the most permissive mode

Every product has a mode that skips prompts. Disable it centrally where you can, and pick the default developers start in. In CI, prefer modes that deny instead of prompt; Kiro treats every ask as a deny in headless runs, and Codex documents a read-only, never-ask combination for review jobs:

codex exec --sandbox read-only --ask-for-approval never "review this diff"

Step 5: Put a gate in front of merge

An approval prompt tells a developer what the agent wants to run. It says nothing about whether the dependency the agent just added has a known vulnerability. Add a check that does not depend on the assistant:

safeguard scan --dir .
safeguard exec "summarise the critical findings in this repository"

Common mistakes

Piloting with personal accounts. Developers on personal plans bypass your SSO and data terms. Force sign-in to your organization from day one.

Leaving MCP open. An MCP server is a new path to your systems. Use the allowlist your product offers, or route servers through a checkpoint.

Assuming cloud agents inherit device policy. Codex's docs say they do not. Review cloud settings separately.

Treating approvals as review. An approved change can still pull in a vulnerable package. See our guide to checking coding agent changes.

Do the work properly with Safeguard: policies, models and the CLI

Every product above has its own admin console. What none of them gives you is one place to set security policy across all of them and the code they produce. That is the job Safeguard does.

Policies, gates and MCP Guardrail

In the Safeguard platform, policies generate findings and gates enforce them at checkpoints such as CI, with actions to block, warn, notify or require approval. Because gates run in the platform, they apply whether the change came from Copilot, Claude Code, Codex, Kiro, Cursor or a person. MCP Guardrail generates guardrail proxy URLs for MCP servers, so agent tool traffic goes through a checkpoint you control instead of straight to the server. The platform adds reachability analysis and autonomous remediation with fix pull requests, which is off by default.

Model controls

Safeguard treats model choice as an admin decision. This demo picks the model for each conversation. Zero z20 answers with no language model at all by turning the question into a platform query; Griffin, Eagle and Lion are Safeguard's own models; a tenant admin chooses which model families people may use; and you can bring your own model on your own provider account and route jobs such as chat or summaries to it:

Click through it at your own pace, or open it full screen.

Keep the plans your teams already pay for

Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. To connect a model, see the CLI docs or run /model in a session.

Teams that live in ChatGPT can bring Safeguard to them instead. This demo connects ChatGPT to the Safeguard MCP server with OAuth and chooses which Safeguard tools ChatGPT can use:

Click through it at your own pace, or open it full screen.

The Safeguard CLI: install and first session

The CLI scans code, container images and SBOMs on your own machine, sends only the results to the platform, and includes an assistant that can fix what it finds. It is a single static binary with no Node, Python or JVM needed, for macOS, Linux and Windows on x86_64 or arm64, with Windows on x86_64 only.

# macOS and Linux
curl -fsSL https://cli.safeguard.sh/install | bash

# Windows (PowerShell)
irm https://cli.safeguard.sh/install.ps1 | iex

Run safeguard to open the interactive terminal, /login to sign in through the browser, and /scan . to scan the current folder. @ attaches a file from the folder you started in, and /resume picks up the last session there.

Writing and fixing code, with approvals

The assistant has tools for your local files and for your Safeguard data and picks whichever the question needs. Ask it to "fix the lodash CVE in this repo" and it writes files, edits code and runs commands, with your approval. It also handles everyday terminal work, such as "what's the latest file in ~/Downloads". /permissions sets how often it asks: Ask prompts before every action, Auto approves known actions and asks for anything new (the default), and Yolo approves everything. For regulated repositories, standardise on Ask.

CI with safeguard exec

safeguard scan takes a folder (--dir .), a repository URL (--repo), a container image (--image) or an SBOM file (--sbom), builds an SBOM, matches it against vulnerability databases and writes JSON files such as vuln.json and license.json under ./output. safeguard validate checks CycloneDX, SPDX and VEX documents, and safeguard exec runs one non-interactive assistant turn for pipelines. Policies and gates are evaluated in the platform, not by the CLI. When the local runner handles platform scan jobs, source code never leaves the machine; only SBOMs and findings are uploaded. More in the Safeguard CLI as a security-aware coding assistant.

One platform on every surface

The download page lists every surface. Start in the terminal with the CLI, continue in the desktop app for Windows, macOS and Linux, and check findings on your phone with the iOS or Android app. There are IDE extensions for VS Code, JetBrains and Open VSX, and a browser extension for Chrome. For nothing to install, use the web interface, the Cloud CLI, or a cloud sandbox tenant against a seeded demo repo, free for seven days with no card.

FAQ

Which assistants let admins restrict the models people can use?

From the docs we read: Copilot requires an admin to enable each model, Kiro takes an approved model list, Claude Code takes availableModels in managed settings, and Cursor Enterprise lists model access restrictions. Safeguard lets a tenant admin choose which model families people may use.

Which assistants can keep inference in our own cloud account?

Claude Code documents Amazon Bedrock, Google Cloud and Microsoft Foundry as providers. Kiro is an AWS service with data stored in the Region of your Kiro profile. Check each vendor's data residency page for your Region.

Can developers override admin settings locally?

Claude Code's docs say no level, including command line arguments, can override a managed permission rule. Codex applies managed requirements to local runs. For other products, test it in the pilot.

Are cloud agents covered by our device policy?

Not automatically. Codex's docs say cloud environments do not inherit local device policy, MDM settings or local network access. Review each cloud agent's own settings.

Do we lose our Claude, ChatGPT or Codex plans if we adopt Safeguard?

No. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server.

Does Safeguard replace Copilot, Claude Code or Codex?

It is not a feature-for-feature replacement. Teams can switch their coding work to the Safeguard CLI, or keep their assistant and use Safeguard's policies, gates and scans across every assistant and every merge.

Is Gemini Code Assist still available to new customers?

Google's overview page says new Gemini Code Assist subscriptions are no longer available for purchase. Existing customers should check with Google.

For a wider feature comparison, see AI coding agents compared and Claude vs ChatGPT for coding.

Try it yourself

This walkthrough sets up the runner on your own machine: pick the platform, start it, approve it with its device code, then use the same CLI to scan from the terminal.

Click through it at your own pace, or open it full screen.

Put one policy in front of every assistant your teams use. Download Safeguard, connect the Claude, ChatGPT or Codex plan you already have, and read the CLI docs.

Quick check

Sources

• GitHub Docs: Copilot plans
• GitHub Docs: Manage Copilot enterprise policies
• GitHub Docs: Supported AI models in Copilot
• GitHub Docs: About Copilot cloud agent
• GitHub Docs: Copilot cloud agent risks and mitigations
• GitHub Docs: Identity and access management for enterprises
• Claude Code docs: Overview
• Claude Code docs: Authentication
• Claude Code docs: Permissions
• Claude Code docs: Amazon Bedrock
• Claude Code licence
• Codex docs: Enterprise admin setup
• Codex docs: Authentication
• Codex docs: Agent approvals and security
• Codex docs: Pricing and plans
• OpenAI Codex repository
• Kiro: Enterprise concepts
• Kiro: Enterprise governance
• Kiro: Permissions
• AWS: Amazon Q Developer IDE plugins end of support
• AWS: Amazon Q Developer pricing
• AWS: Amazon Q Developer service improvement
• AWS: Data storage in Amazon Q Developer
• Cursor docs: Enterprise
• Google Cloud: Gemini Code Assist overview
• Safeguard download page
• Safeguard CLI docs
• Safeguard CLI docs: Interactive terminal

Last reviewed: 21 October 2026.