Governing AI Coding Agents on Developer Laptops

A coding agent on a laptop runs as the developer. It reads the same keychain, carries the same tokens and appears in every downstream log under the same name. The identity record is accurate and it cannot answer the question governance needs answered.

‍

Every control keyed to identity therefore operates on a merged subject. Access review, least privilege, behavioral baselining and segregation of duties all treat the developer and the agent as one actor, so the agent's activity is normal by construction.

‍

What Does the Identity Log Leave Out?

‍

Initiation, which is the only field that distinguishes the two actors sharing the credential.

‍

What It Records

‍

That a developer authenticated, that a token was issued, that a call reached a repository or a database under that token. All true, all attributed correctly to the person whose credential was used.

‍

What It Cannot Separate

‍

A commit the developer wrote from a commit the agent produced, since both arrive signed by the same key. The distinction exists in the world and not in the record, which is why reconstructing it afterward is usually impossible.

‍

Why Baselining Breaks

‍

Behavioral detection learns what normal looks like for an identity. Where the agent's activity is included in that history, the baseline absorbs it, so an agent operating unusually looks like a developer whose habits changed.

‍

What Should the Inventory Capture?

‍

Three installation shapes, and the third is the one point-in-time scanning misses.

‍

• Editor extensions: Assistants installed inside a development environment, persistent and enumerable from the editor's own configuration.
• Command line tools: Agents installed through a package manager, persistent on disk and visible to an endpoint inventory.
• Ephemeral local servers: Tool servers started on demand through a package runner, existing only while a session runs.

‍

Why the Third Defeats Scanning

‍

A server spun up for one session and gone afterward is absent from any scheduled inventory and present during the work that matters. Catching it requires process-level observation at the time rather than a periodic snapshot.

‍

What the Inventory Entry Needs

‍

The developer, the agent, the model provider behind it and the repositories it has touched. Without the fourth field the entry records what exists rather than what it reached.

‍

How Do You Scope Permissions You Do Not Grant?

‍

Reduce what the credential store holds, since the agent inherits rather than requests.

‍

The Inheritance Problem

‍

An agent reading a local keychain has whatever the developer has, including tokens issued years ago for systems nobody associates with development. Scoping the agent means scoping the developer, which is an unpopular conversation with a sound basis.

‍

What Reduces It

‍

Short-lived credentials that expire rather than persist, separate stores for personal and delegated tokens, and removal of standing grants to production systems. Counting standing grants before shortening them establishes the population first.

‍

The Better Arrangement

‍

An agent holding its own identity with its own grants, so authority is granted deliberately rather than inherited. Managing agent identity at scale covers how that works where the platform supports it, and a local process on a laptop frequently does not.

‍

What Should Be Logged Locally?

‍

Four categories, all of which stay on the machine and none of which a network control observes.

‍

Credential Access

‍

Which credential type was requested and at what sensitivity, recorded as a handle rather than a secret, alongside the moments the local keychain was opened, closed or modified. Recording the mapping rather than the token keeps the log safe to retain.

‍

Shell and File Activity

‍

Exact command strings the agent executed, package installations it performed, and files it read or wrote. Reads of environment files, local configuration and private keys deserve separate treatment, since those are the paths credential theft takes.

‍

Local Tool Invocations

‍

Names of tools called on locally started servers, the parameters passed and whether execution succeeded. Arguments matter more than names, since a permitted tool reading an impermissible path is visible only in what it was asked for.

‍

What Does the Gateway Still Give You?

‍

A denominator, which is a smaller contribution than it sounds and a necessary one.

‍

Coverage Measurement

‍

Agents routed through a gateway are the counted population, and agents on laptops are what the count omits. Comparing endpoint-observed agents against gateway-observed ones produces the coverage figure, and measuring coverage against the gateway log sets out the arithmetic.

‍

Why the Comparison Matters More Here

‍

Development populations are where the uncounted agents concentrate, since local execution is the normal pattern rather than an exception. A coverage figure calculated without endpoint data will read high and be wrong by the size of the engineering team.

‍

What Can Be Done Without New Tooling?

‍

Three things, each available to a team with no budget this quarter.

‍

Ask the Editors

‍

Development environments enumerate their own extensions, and a short script collecting that list across the fleet produces a first inventory in an afternoon. It misses the ephemeral category and covers the other two.

‍

Expire the Tokens

‍

Shortening credential lifetime reduces what any agent inherits without configuring any agent. The control applies to the store rather than to the tools reading it, which is why it works on agents nobody has inventoried yet.

‍

Record Initiation Where You Can

‍

Some agents mark their own commits and some platforms support an attribution field. Using it where available separates the two actors in the systems that matter most, even where the laptop itself stays opaque.

‍

How Is This Different From Agents Built in Approved Platforms?

‍

Different population, different mechanism and a different discovery problem.

‍

What the Other Case Looks Like

‍

An agent assembled inside a tool the organization approved, where the approval covered the platform and not the things built in it. Agents built in approved tools works through why the inventory never catches up there.

‍

Why Local Agents Are Harder

‍

A platform-built agent exists somewhere centrally, so a query against the platform can find it. A local agent exists on one machine, acts as its owner, and leaves the organization's systems only through calls indistinguishable from that person's own.

‍

What Should Be Established?

‍

Three things, and the first is a measurement rather than a policy.

‍

How many agents run on engineering machines against how many appear in the gateway count, since the difference is the ungoverned population. Which credential types sit in developer keychains and how long they live, because that is what any agent inherits. Then whether any system in the chain records initiation, so a human action can be told from an agent one. Governing agents at the boundary covers the routed population, and the platform reads endpoint signals alongside gateway and identity sources so the uncounted half becomes visible.

‍

The Credential Is Shared, So the Record Is Merged

‍

A coding agent on a laptop runs as the developer, reads the same keychain and appears downstream under the same name, so every identity-keyed control treats the two as one actor and the agent's activity becomes normal by construction. Inventory has to cover three installation shapes, with tool servers started on demand defeating scheduled scanning because they exist only while a session runs. Scoping works on the credential store rather than on the agent, since an agent inherits whatever the developer holds. The logging that matters is local, covering credential handles, shell commands, reads of environment files and private keys, and tool invocations with their arguments. A gateway still supplies the denominator, and a coverage figure calculated without endpoint data reads high by the size of the engineering team.

‍

To see endpoint agent activity read alongside gateway and identity signals, book a demo mapped to your own estate.