Enterprise AI Agents: A Buyer's Guide to the Controls

An enterprise AI agent is ready to buy when you can verify six things from the vendor's own documents: sign-in and provisioning, central policy, audit logs, retention and training terms, data location, and spend caps. On 2026-10-31 no vendor we checked publishes all six in full. This guide shows what each one states and where the gaps are.

What we checked, in one table

Read the table as a list of questions to ask, not as a ranking. The rest of this page explains each row, with the source for each claim in the frontmatter. For individual vendors see Anthropic, OpenAI and Google AI, and for the agents see Claude Code, Cursor and GitHub Copilot.

What "enterprise agent" means

The word "agent" covers three different products, and each one carries a different risk.

Most enterprise purchases start with the first kind, because developers adopt it first. The security side of that is on enterprise AI coding agent security. The second and third kinds raise governance questions, covered on AI agent governance, and a build-or-buy question, covered on build vs buy AI agents.

Identity, provisioning and central policy

An enterprise rollout fails if every developer configures the tool by hand. Look for three things.

1. Single sign-on and provisioning. Cursor lists SSO and SCIM in its enterprise administration documents, and its audit log labels membership changes driven by an identity provider as SCIM. GitHub says SAML SSO and user management sit in the business tiers, not in the individual plans. Mistral lists SAML SSO and audit logs on its Enterprise plan.
2. Policy users cannot override. Claude Code reads settings from four files and can also receive managed settings from the claude.ai console. The docs say managed settings apply to everyone your organization deploys them to, and that some settings are decided for the user so that nothing in their own files changes them. Delivery is by a managed-settings.json file, an MDM policy, or server-managed settings. Cursor documents MDM deployment.
3. Role separation. Cursor's audit log records role changes between owner and member, spending-limit changes and API key creation, which implies separate admin roles. Ask each vendor for its role matrix.

If a vendor cannot show you where an admin sets a policy that a user cannot change, the tool is a personal product with a company logo on it.

Audit logs: what is and is not recorded

An audit log answers "who changed what." It does not answer "what did the agent do," and buyers often confuse the two.

Cursor's documentation is a good example of honesty. Its audit log records sign-ins, membership, roles, API keys, settings, integrations and cloud agent environments, with the time, the actor, the client IP and the product surface. It also lists what is not logged: agent responses, prompts and generated code, failed sign-in attempts, and secret values. For development activity it points to hooks.

Anthropic describes a Compliance API with an Activity Feed that retains data for six years, plus access to chat, file and project content, and session transcripts. Claude Code can export usage, cost and tool activity through OpenTelemetry, configured with standard environment variables. GitHub lists audit logs on Copilot Business and Enterprise.

The last row shows the tension. Zero retention and full audit logging pull in opposite directions. Decide which you need for each data class, and write it down.

Retention, training and the frontier-model exception

All five vendors say something about training. They say it in different ways, so compare the wording.

Retention is where it gets complicated, because the strongest models are the exception. Anthropic's Fable 5.1 and Mythos 5.1 require 30-day retention and are not available under ZDR unless Anthropic authorizes it. GitHub's plans page says that when Fable 5 or 5.1 is used, Anthropic retains prompts and outputs by default to run safety classifiers. GitHub describes a time-bound exemption that lets approved enterprises use ZDR with those models through the end of 2026, after which continued use would require what it calls Enterprise Frontier Safeguards. It adds that customers using a Fable model with ZDR agree to use it for internal operations only. Cursor's documents say requests to Fable models fail for Enterprise customers and for those with Privacy Mode on, until the model's data retention is approved.

For a buyer the rule is simple. If your policy is zero vendor retention, check each model on the shortlist, and expect that your best model may not meet it. The practical answer is often a two-tier approach: the strongest model for non-sensitive work, and a model that qualifies for ZDR on sensitive repositories.

Residency

Three vendors describe a way to control where data is processed.

• Anthropic: an inference_geo setting with values us and global, on Claude 4.6 and later models, with a US workspace geo today.
• OpenAI: per-project data residency for eligible customers after contacting sales, with regional hostnames, a 10 percent uplift on eligible newer models, and extra paperwork outside the US.
• Cursor: a data residency program in which inference, processing and storage for in-scope features stay in the selected region, including backups. It also offers customer-managed encryption keys for data in its own infrastructure.

Google's Gemini Developer API terms say logged data may be stored transiently or cached in any country where Google or its agents have facilities, so a buyer who needs a region should read the cloud terms instead. See AWS Bedrock for the cloud-marketplace route to Claude, where the cloud provider's own region controls apply.

Spend controls

Agents can run in loops. A control that stops spending is a safety control. Anthropic has monthly spend caps by tier, from $500 at Start to $200,000 at Scale, and lets you set a lower limit. OpenAI ties usage limits to tiers. Google has spend-based rate limits by tier. Cursor's audit log records per-user spending-limit changes, which means limits exist per person. GitHub Copilot sells credits per seat, with Business at 1,900 credits per user and Enterprise at 3,900, where one credit is one cent. Whatever you buy, set a cap before the first pilot user is invited.

A pilot that tests the controls

A pilot should test the controls, not just the model. A sensible plan has four steps.

1. Write the data rule. Which repositories and data classes may be sent, and which may not.
2. Shortlist two or three vendors that can meet it on paper, using the table above.
3. Run a four-week pilot on non-sensitive repositories with 10 to 20 developers. Turn on every control you plan to rely on, so you find out what breaks.
4. Review the audit trail. Pick five events, such as a role change and a key creation, and prove you can find them in the log.

Only then widen. Our build vs buy page covers when to run agents of your own.

Which route fits which company

Content exclusion is worth a note. GitHub says repository administrators, organization owners and enterprise owners can configure it on Copilot Business and Enterprise, and that excluded files are not used as context, do not inform suggestions in other files, and are not reviewed by Copilot code review. It is a practical way to keep secrets files, customer data samples and licensed code away from the model without banning the tool outright.

Mistakes we see in buyer reviews

These are patterns in how reviews are done, drawn from reading the documents above, and not claims about any one company.

1. Reviewing the brochure, not the terms. A security page states intent, and the data processing addendum states the obligation. Ask for the addendum, and read the section on the vendor acting as a controller, since training rights often sit there.
2. Treating the consumer terms as the enterprise terms. Anthropic's own retention page separates the API, the consumer apps and the Compliance API, with different periods. A buyer who reads one section and applies it everywhere will get it wrong.
3. Forgetting the model list changes. A model that met your retention rule last quarter may be replaced by one that does not. Pin the list of approved models and check it when a vendor announces a new default.
4. Assuming zero retention covers every feature. Anthropic marks some features, such as code execution, as outside ZDR, and OpenAI lists endpoints that may still store application state under ZDR. Check the feature table for every feature you use.
5. Skipping the exit. Ask what you can export and what is deleted when you leave, and test the export in the pilot.
6. Logging too much. An audit store that holds every prompt becomes your next sensitive data store. Decide what to log, who may read it and how long to keep it.

Questions to put in the security review

A buyer's checklist

1. Write the data rule and get legal sign-off before talking to vendors.
2. Fill the control table for each shortlisted vendor from its own documents, and mark gaps.
3. Check frontier models separately against your retention rule.
4. Set spend caps before the pilot.
5. Lock policy through managed settings, MDM or the admin console.
6. Prove you can find five audit events.
7. Decide how logs of agent activity are collected, since admin logs do not cover it.
8. Record the vendor documents you relied on, with the date, because they change.

Our take

The vendors have more to show than a year ago. Anthropic and OpenAI publish retention terms in detail, and Cursor publishes what its audit log leaves out, which is a useful kind of honesty. The gaps are consistent too: the newest models are the ones that need retention, an audit log of admin actions is not an audit of agent actions, and residency is mostly a sales conversation. Treat any vendor that cannot tell you these things in writing as unfinished. The sources are public, so the cheapest due diligence is to read them, and to re-read them every quarter.

We have not run tests for this page. It reflects the vendors' published documents on 2026-10-31, and the items marked VERIFY are ones we could not confirm. This is not legal advice. If you want providers who set these controls up for a living, get quotes from AI service providers.

Related pages

Enterprise AI coding agent security, AI agent governance, build vs buy AI agents, private AI for teams, Claude Code pricing.