What Platforms Document: No Vendor Covers the Full Row, and the Silence Clusters at Team Scale

No shipping platform documents all seven compliance properties. This page grades each platform on what its public documentation says, the published counterpart to the in-house platforms and the eight case studies elsewhere in this section. The closest platform, GitHub Copilot's cloud agent, earns two full checks and is partial or silent on the other five. No platform's row has more than two checks. Four columns, audit trail, isolation and residency, reproducibility, and dependency provenance, have zero full checks. The seventh property, dependency provenance, is this handbook's prescription rather than observed practice: GitHub documents a partial known-bad check, but no vendor documents the full install-path gate.

One methodological rule: absence of documentation is not evidence of absence. These verdicts grade what each vendor publishes, because published behavior is what a buyer can rely on and an auditor can cite. A platform may do better than its docs. A control you cannot point to in writing is a control you cannot put in an audit.

The matrix: every platform is strong somewhere, none covers the row

Scale: ✅ documented and meets the bar · partial documented but incomplete · undoc. the docs are silent.

Brex's cells deserve a gloss: theirs is a build log, not product docs, so "undocumented" there means "not published," a lower bar of silence than a vendor omitting it from security documentation. The per-property arguments behind every cell are in the platform comparison matrix.

Each property has a different leader, and no leader covers two

Attribution. Copilot stands alone. Commits are signed, "authored by Copilot," with the requester marked as co-author, the only complete documented chain from AI actor to named human. Cursor has the cryptographic half (HSM-backed Ed25519 signatures, verifiably "from Cursor") without the human binding. Codex and Jules say nothing about commit identity.

Audit trail. Anthropic and Shopify have the right substrate, nobody has the auditor's interface. Anthropic's session is "the append-only log of everything that happened," durable and external, which is the correct primitive; Shopify's River pairs a Postgres event log with public Slack transcripts, two durable records. Both stop at the same line: the log exists to resume or read a session, not to answer an auditor's query per actor and time window.

Least privilege. Anthropic documents the pattern, Codex ships the best default. Anthropic's tokens-never-reachable-from-the-sandbox is the structural bar; Codex's docs state that secrets "are removed before the agent phase starts" and route all egress through a proxy with methods restricted to GET, HEAD, and OPTIONS. Cursor has the field's most granular egress controls but pairs them with documented defaults of auto-running all terminal commands and internet access on.

Isolation and residency. Isolation is broadly solved, residency by nobody. Per-task containers or VMs are table stakes across all seven rows, with Codex's shared Business and Enterprise caches as a documented dent. Regional placement of execution or data is documented by no one. See isolation and residency for why that column matters.

Segregation of duties. Copilot stands alone, and thoroughly. Copilot cannot approve, cannot merge, cannot mark its own PRs ready for review, and GitHub prevents the requester from approving the agent's PR. No other platform documents even one enforced rule; the rest inherit whatever the customer's SCM enforces.

Reproducibility. Everyone is partial, Shopify least so. Snapshots, pinned images, or provisioning recipes exist everywhere, and Shopify's Nix-everything substrate (dev, CI, and production from one reproducible build) is the strongest of the group. It still lands at partial, because the one thing none of them encodes is the change-management process itself: the write, review, approve, ship sequence recorded per task exists nowhere.

Dependency provenance. Copilot is partial, everyone else is silent. GitHub documents an advisory-database check for newly introduced dependencies, which catches known-bad packages. The full bar is stricter: package identity, release age, publisher, and advisory/provenance status checked before install in the agent environment, not only at PR completion. No platform documents that.

The silence clusters exactly where teams and auditors live

Four gaps recur across the rows: no data residency or placement controls anywhere; no auditor-facing, per-actor queryable audit API, even where the underlying log exists; no AI identity scoped to the initiating human, as opposed to one shared bot identity per vendor (Copilot's co-author field is the closest documented approximation); and no dependency-provenance gate that treats packages as untrusted inputs. A fifth, narrower one: credential scrubbing before snapshot appears in no platform's docs, and Cursor's docs describe the failure mode shipping: .env.local files included at snapshot creation "will be saved" into the image.

The gaps are not random; they cluster on the properties that only matter at team-and-auditor scale. Single-user safety, sandboxing, secrets handling, and egress are where vendors compete and document heavily. Residency, queryable audit, per-human identity, enforced gates, and package-identity checks are where the docs go quiet. That asymmetry is the laptop model showing up inside the products: every platform has moved the execution off the laptop, and most have left the accountability model on it.

The caveat: with this many undocumented cells, some gaps are documentation debt rather than capability gaps. For a buyer under SOC 2 or ISO 42001, the distinction is academic until it is in writing. The procurement move is simple: run the seven properties as a documentation request, and treat "we do that but haven't written it down" as a no until the writing arrives.