Coding agents arrive on developer laptops, running on your developers' own standing credentials, against your repos and your CI. Their permissions live in a settings file on each machine. Agen governs the same agents at runtime, per action, with a named human behind every one.
It never crosses your network controls, and no log outside that machine records the attempt. AgenShield stops it on the device.
Copilot adoption was a decision security was in the room for. Coding-agent adoption usually was not. One card per group in the comparison below.
Allow rules, deny rules and approval prompts sit in a settings file on each machine. They configure one tool on one device, they do not follow the developer to the next agent, and nothing outside that machine sees the decision.
It runs on standing credentials that already reach your repos and your CI. When something lands badly, the author field reads a person's name, and nothing on the machine can say whether that person chose the action or the agent did.
Jira, GitHub, the internal API, the production database. Each server the agent connects to widens what a single prompt can reach, and the allowlist deciding which ones are permitted lives in the same local file as everything else.
Every coding agent has its own settings format, on every laptop that runs it. There is no central place to write a rule, no place to see what was decided, and nothing to hand an auditor who asks what your developers' agents did last quarter.
Managed settings do real work, and engineering should keep them. They answer a different question than the one you are accountable for.
~/.claude/settings.jsonthis machine~/.codex/config.tomlthis machine~/.cursor/settings.jsonthis machineThree formats, one per tool, on every laptop that runs one. No central verdict, no record anyone outside the machine can read, and nothing carries over when a developer switches agents.
Agen against the controls coding agents ship with. Scored 0 to 5 on capability depth, capability by capability, including the rows the native controls win.
| Capability depthNoneComplete | Native coding-agent controls |   |
|---|---|---|
| 01 · Runtime enforcement | ||
| Verdict rendered at the moment of action | Native coding-agent controlsPer-call hooks, on the laptopStrong4/5 | Agen.coPer-action verdicts, <30msComplete5/5 |
| Decision latency, published and measured | Native coding-agent controlsNot publishedNone0/5 | Agen.co<30ms, published, no samplingComplete5/5 |
| Blocks a single action without disabling the agent | Native coding-agent controlsDeny rules, per callComplete5/5 | Agen.coAction-level enforcementComplete5/5 |
| Audit-first rollout mode before enforcing | Native coding-agent controlsLog-only hook, self-builtBasic1/5 | Agen.coObserve-only modeComplete5/5 |
| 02 · Identity & accountability | ||
| A named human accountable for each agent | Native coding-agent controlsSeats, not agent instancesBasic1/5 | Agen.coNamed owner, every agentComplete5/5 |
| Each individual action attributed to that human | Native coding-agent controlsOff by default, your collectorCapable3/5 | Agen.coAttributed per actionComplete5/5 |
| Access evaluated at action time, not only at grant time | Native coding-agent controlsMCP servers cleared at connectCapable3/5 | Agen.coJudged in context, per actionComplete5/5 |
| Audit record per action | Native coding-agent controlsLocal to the machinePartial2/5 | Agen.coA record per actionComplete5/5 |
| 03 · Coverage | ||
| Endpoint enforcement | Native coding-agent controlsManaged settings, client-sideStrong4/5 | Agen.coAgenShield on the deviceComplete5/5 |
| MCP tool governance | Native coding-agent controlsAllowlists, per tool, per fileStrong4/5 | Agen.coMCP tools governed per callComplete5/5 |
| Shadow-agent discovery | Native coding-agent controlsDocumented bypasses, no detectionBasic1/5 | Agen.coShadow AI surfacedComplete5/5 |
| Browser enforcement | Native coding-agent controlsOut of scopeNone0/5 | Agen.coBrowserShield, early accessCapable3/5 |
| 04 · Operate & buy | ||
| Prerequisite licensing | Native coding-agent controlsA file on disk, any planComplete5/5 | Agen.coNo prerequisite tierComplete5/5 |
| Depth inside the developer's own loop | Native coding-agent controlsNative, no round tripComplete5/5 | Agen.coGoverns the tool, not inside itPartial2/5 |
| Consoles to operate | Native coding-agent controlsOne per tool, plus MDMPartial2/5 | Agen.coOne console, one policy planeComplete5/5 |
Every coding agent, its machine identity, and the human authority behind it, in one screen.
Three capabilities on one identity fabric. Keep the tools engineering chose and keep the identity provider you already run; Agen governs on top of both. Days to a first governed agent, no agent recreation.
Continuous discovery across your IdP, gateway, devices, cloud, and registries. Nothing has to self-register: agents are found, risk-scored, and resolved to a named human before they act.
We come back with every coding agent we find, the credentials each one runs on, and whether a named human is accountable for it. Tell us anything we should know in the comments.
