How to Govern AI Coding Agents at Scale

TL;DR

• Gartner predicts 90% of enterprise software engineers will use AI code assistants by 2028, up from less than 14% in early 2024, and much of that traffic can leave developer laptops outside any policy layer.
• Governing AI coding agents at scale takes two layers: an AI gateway that defines and enforces policy, and endpoint enforcement that routes every agent through it.
• The Bifrost AI gateway applies virtual keys, budgets, rate limits, MCP tool filtering, and request logging to every coding agent request it receives, with guardrails and audit logs in Bifrost Enterprise.
• Bifrost Edge, currently in alpha, routes traffic from Claude Code, Codex CLI, Cursor, and OpenCode through the gateway at the machine level and enforces MCP server allow and deny decisions on each device.

Gartner predicts that 90% of enterprise software engineers will use AI code assistants by 2028, up from less than 14% in early 2024. That growth makes governing AI coding agents at scale a security and compliance problem, because tools like Cursor, Claude Code, and GitHub Copilot send prompts and source code to model providers from every developer laptop, often outside any policy layer. Bifrost, the open-source AI gateway built in Go by Maxim AI, is the control plane for that traffic: it routes, governs, and secures every AI request through virtual keys, budgets, rate limits, and, in Bifrost Enterprise, guardrails and audit logs. Bifrost Edge extends that same governance to every machine, so supported coding agents are governed automatically instead of only the traffic someone remembered to configure.

Why AI coding agents are hard to govern at scale

AI coding agents are hard to govern because each one talks directly to a model provider from the developer's machine, and most of that traffic is never configured to pass through a control point. A gateway only governs the requests pointed at it. Everything else is invisible to security and platform teams.

The scale is the core of the problem. GitHub Copilot passed 20 million all-time users in July 2025, and Cursor has grown into a standard editor for many engineering teams. In practice, a single organization runs several agents in parallel: Claude Code and Codex CLI in the terminal, Cursor in the IDE, Copilot inline, plus browser chat for quick questions. Each of these adds an independent path out of the company to an external API.

This is the engineering version of shadow AI: ungoverned AI usage that platform teams cannot see. Developers adopt agents individually, often through personal subscriptions, so the traffic never appears in any inventory. ISACA describes the pattern directly, noting that a developer using a personal Copilot subscription to generate production code can create unmonitored information flows and compliance exposure. Governing this at scale means bringing every agent under one AI governance layer without asking developers to reconfigure their tools. This comparison of AI governance tools for coding agents shows how different products approach the problem.

The risks of ungoverned AI coding agents

The risks of ungoverned AI coding agents are credential and source code leakage, uncontrolled spend, unmonitored MCP servers, and missing audit evidence. Each one is invisible without a governed path. Ungoverned coding agents introduce four concrete risks that compound as adoption grows across an engineering organization:

• Secret and source leakage. Agents send code, and sometimes configuration files, to model providers. Developers troubleshooting a bug can paste scripts containing hardcoded API keys, database credentials, and access tokens into AI tools, exposing them to a third party with no redaction in between.
• No cost control. Without per-team budgets or rate limits, agent usage runs against provider keys that no one is tracking, and spend is only discovered on the monthly invoice. The patterns behind that spend are covered in this guide to AI gateways for tracking coding agent spend.
• Unmonitored MCP servers. Coding agents increasingly connect to Model Context Protocol (MCP) servers that can read files, call APIs, and take actions. Most teams have no inventory of which servers are wired into which tools.
• No audit trail. When prompts and completions never pass through a governed path, there is no record for SOC 2, GDPR, HIPAA, or ISO 27001 review, and no way to answer what data left the company through which agent.

Governing AI coding agents at scale means closing all four gaps with the same set of policies, applied consistently whether the agent runs in a terminal, an IDE, or a browser.

Govern coding agents at the gateway with Bifrost

The first layer of governing AI coding agents is the control plane. The Bifrost AI gateway sits between every agent and every model provider, and it is where policy is defined and enforced. Point a coding agent at the Bifrost endpoint and every request it makes inherits the organization's rules.

Bifrost provides OpenAI, Anthropic, and Google GenAI compatible endpoints, so agents integrate by changing a base URL rather than swapping SDKs.

Claude Code, Codex CLI, and Cursor all route through Bifrost this way. Once an agent points at the gateway, these controls apply to every call:

• Virtual keys as the unit of governance. Virtual keys carry per-team access permissions, so a team's agents can only reach approved providers and models.
• Budgets and rate limits. Hierarchical budget and rate-limit controls cap spend at the virtual key, team, and customer level before it happens.
• MCP tool filtering. Bifrost controls which MCP tools each virtual key can reach, so an agent only gets the tools its team is cleared to use.
• Guardrails. Guardrails inspect prompts before they reach a model and responses before they return, catching secrets and PII at the boundary.
• Request and audit logs. Request logging records every agent call with its inputs, outputs, tokens, cost, and latency, and signed audit logs record administrative changes for SOC 2, GDPR, HIPAA, and ISO 27001 review.

Bifrost also functions as an MCP gateway, so the external tools agents call are themselves routed and governed. Teams standardizing on Model Context Protocol can dig into the MCP Gateway resource and the breakdown of MCP access control and cost governance at scale. Together, these controls are the foundation of governance for coding agents: one place to define policy for all agent traffic. For Claude Code specifically, see how an MCP gateway centralizes tool access for agentic coding.

The gateway has one structural limit. It governs only the traffic that is configured to point at it. If a developer installs a new agent, or uses one through a personal account, that traffic bypasses the control plane entirely. Closing that gap at scale is what Bifrost Edge is for.

Extend governance to every machine with Bifrost Edge

Bifrost Edge is the endpoint layer that carries the gateway's policies out to every device. The Bifrost gateway remains the control plane where virtual keys, budgets, guardrails, and audit logs are defined; Bifrost Edge runs on each machine and routes all AI traffic through that gateway automatically. There are no base URLs to change and no SDKs to swap, so governance follows the developer instead of waiting for them to opt in. Bifrost Edge is currently in alpha.

This matters most for coding agents, which are installed per developer and often cannot be centrally pointed at a custom endpoint. Edge routes at the machine level, so supported agents developers run are governed the moment it is installed. Edge governs a growing list of AI surfaces today, including Cursor, Claude Code, Codex CLI, and OpenCode, with a request option for any tool not yet covered. Because routing happens on the device rather than inside each app, supported agents that resist per-tool configuration are still brought under policy.

Edge adds two governance capabilities that are specific to the endpoint:

• App governance. Administrators decide which AI applications are allowed on company machines. Allowed apps run normally and fully governed; disallowed apps are blocked before any data leaves the device. When Edge discovers a new app, it requests approval in the admin console automatically.
• MCP governance. Edge inventories the MCP servers configured inside each coding agent and builds a live, fleet-wide list of which servers are running, where, and on how many machines. Admins make per-server allow or deny decisions, and a denied server is blocked on the device, even if an agent had it configured before the policy existed.

Because Edge routes endpoint traffic through the gateway, the same guardrails that protect gateway traffic now protect prompts and completions from coding agents. Secrets detection and PII rules run before a prompt reaches a model provider, which directly addresses the credential-leakage risk. The guardrails themselves are configured once at the gateway and enforced everywhere, which is the core of the combined model: the AI gateway defines policy, and Bifrost Edge enforces it on every machine. The same model applied to the wider enterprise is covered in deploying AI governance with Bifrost Edge and the Bifrost gateway.

The table below shows which layer closes each risk of ungoverned AI coding agents.

How to roll out coding-agent governance across your fleet

Governing AI coding agents at scale is a fleet operation, not a per-developer one. Bifrost Edge supports rollout through the device management platforms teams already run, so it reaches every machine without manual setup.

The MDM deployment path works across macOS, Windows, and Linux and supports Jamf, Microsoft Intune, Kandji, Omnissa Workspace ONE, and JumpCloud. The rollout has three steps:

1. Package and push. Edge installs silently through your MDM with a managed configuration that points it at your Bifrost. No secrets live on the device.
2. Sign in once. On first run, each developer signs in through the browser using existing SSO, which links the machine to the user and syncs their assigned policies.
3. Govern automatically. From that point, all supported AI traffic is routed and governed, and Edge keeps policy in sync with the gateway on its own.

Admins manage the fleet from a devices dashboard that lists every machine, its installed agents, and its configured MCP servers, and an approvals dashboard where app and MCP catalogs are deduplicated across the fleet: approve or deny an MCP server once and it applies everywhere.

For regulated environments, this endpoint governance connects to the broader Bifrost Enterprise capabilities, including RBAC, SSO and OIDC, and in-VPC deployment. Once agents are governed, monitoring Claude Code and other coding agents turns the logged traffic into usage and cost reporting.

Frequently asked questions about governing AI coding agents

Can you govern coding agents without changing how developers work?

Yes. There are two paths. Point agents at the gateway by changing a base URL, or install Bifrost Edge, which routes traffic transparently at the machine level with no per-app configuration. With Edge, developers use their agents exactly as before while policy applies in the background. For the base URL path, the Bifrost CLI setup for coding agents walks through the configuration.

How do you control which MCP servers coding agents can use?

Bifrost Edge inventories the MCP servers configured in each agent across the fleet, and admins make per-server allow or deny decisions that are enforced on each device. At the gateway, MCP tool filtering controls which tools each virtual key can reach, so control exists at both the endpoint and the request level.

Does routing coding agents through a gateway slow them down?

Not meaningfully. Bifrost adds 11 microseconds of overhead per request at 5,000 requests per second in sustained benchmarks, which is negligible next to model response times.

What is shadow AI in software engineering?

Shadow AI in software engineering is coding agent and AI assistant usage that bypasses approved access paths, such as a developer running Claude Code or Copilot through a personal subscription. The traffic carries source code and sometimes credentials to external model providers, yet never appears in any inventory, budget, or audit log that security and platform teams can review.

Is Bifrost Edge generally available?

No. Bifrost Edge is currently in alpha, and teams request access through the alpha sign-up on the Edge overview page. The Bifrost AI gateway, including virtual keys, budgets, rate limits, and MCP tool filtering, is available today as open source, with guardrails, RBAC, and audit logs in Bifrost Enterprise, so teams can govern configured agent traffic before rolling out Edge.

What about coding agents that cannot be pointed at a custom gateway?

Endpoint routing covers this case. Because Bifrost Edge routes at the machine level rather than inside each app, supported agents that do not expose a configurable endpoint are still brought under governance, and their traffic inherits the same guardrails and request logging as everything else. Agents not yet on the supported list can be requested from the Edge docs.

Governing AI coding agents at scale with Bifrost

Governing AI coding agents at scale comes down to two layers working together: a control plane that defines policy for all agent traffic, and endpoint enforcement that reaches every developer machine. The Bifrost AI gateway is where virtual keys, budgets, guardrails, and audit logs live, and Bifrost Edge carries those same controls to the coding agents developers run on their laptops, without asking anyone to reconfigure their tools. That combination turns shadow AI in engineering into governed, auditable usage across the fleet. Teams still choosing a stack can compare the options in this roundup of governance tools for AI coding agents.

To see how to govern AI coding agents across your organization, book a demo with the Bifrost team.