Platform Comparison Matrix: No Vendor Documents More Than Two of the Seven Properties

No shipping platform documents all seven compliance properties, and no row earns more than two full checks of seven. The leader, GitHub Copilot's cloud agent, takes those two (attribution and segregation of duties) and is partial or silent on the other five. Four of the seven columns, audit trail, isolation and residency, reproducibility, and dependency provenance, hold zero full checks across every vendor.

One methodological rule, applied everywhere: absence of documentation is not evidence of absence. These verdicts grade what each vendor publishes, because published behavior is what a buyer can rely on and an auditor can cite. A cell marked "undoc." means the collected docs say nothing either way; the platform may do better than its docs. That is itself a finding.

The same rule applies to the sponsor. Wallfacer (disclosure: the sponsor of this guide) is graded on its published documentation only, and its row is almost entirely undocumented. The architecture described in its case study reached this guide through the sponsor relationship, not through public security documentation, so under this matrix's rule it does not count.

Every cell, graded on what the vendor publishes

Verdict scale: ✅ documented and meets the property's bar · partial documented but incomplete against the bar · ❌ docs describe behavior that violates the property · undoc. the docs are silent.

Column scores: no column has more than two full checks, and columns 2, 4, 6, and 7 have zero full checks. Row scores: no row has more than two full checks.

GitHub Copilot cloud agent: the most complete story shipped

Source: About the cloud agent and the risks-and-mitigations appendix; firewall docs.

Attribution: ✅. Alone in the field. Commits are "authored by Copilot, with the developer who assigned the issue or requested the change to the pull request marked as the co-author," signed, and shown as Verified "so they appear as made by Copilot cloud agent and have not been altered." Automations extend the chain: PRs opened by an automation "are attributed to the user who created the automation." The one gap is scoping: Copilot is a single shared actor, not a per-human AI identity; the human binding lives in the co-author field, not the credential.

Audit trail: partial. "Session logs and audit log events are available to administrators," and each agent-authored commit message links to its session logs. Whether the log is append-only, externally durable, or queryable per actor and time window is not described.

Least privilege: partial. The agent "can only perform simple push operations," only to a single copilot/ branch; an internet firewall restricts egress; hidden characters are filtered from input. Cutting the other way, two documented gaps: "Copilot cloud agent doesn't account for content exclusions," so administrator-excluded files are visible and editable, and where the agent's GitHub credential lives relative to model-executed code is not described.

Isolation and residency: partial. Each task runs in "its own ephemeral development environment, powered by GitHub Actions." Residency and session-data location appear nowhere in the collected docs.

Segregation of duties: ✅. Documented thoroughly. Four enforced rules: draft PRs "must be reviewed and merged by a human"; Copilot "cannot mark its pull requests as 'Ready for review' and cannot approve or merge a pull request"; GitHub "prevents the user who asked Copilot cloud agent to create a pull request from approving it"; and Actions workflows wait for a human with write access. No other platform documents even one enforced rule.

Reproducibility: partial. Configured via copilot-setup-steps.yml, with a hard 59-minute session cap that keeps each log finite. No versioned known-good images.

Dependency provenance: partial. This is the only install-adjacent gate any vendor documents. "Newly introduced dependencies are checked against the GitHub Advisory Database for malware advisories, and for any CVSS-rated High or Critical vulnerabilities" before the PR completes. That is known-bad detection: a freshly registered slopsquat has no advisory yet, and the recommended firewall allowlist opens the popular package registries across roughly 12 language ecosystems.

OpenAI Codex cloud: the best credential defaults, silent on identity

Source: Codex cloud docs, plus the environments, internet-access, and sandboxing pages.

Attribution and audit trail: undocumented. The docs never say whose identity lands on a commit. The setup flow ("connect your GitHub account") suggests work flows through the user's own connection, which would be the borrowed-identity pattern this handbook rules out, but that is an inference; the docs do not state it. A "work log" is mentioned; no durability, retention, or query interface is described.

Least privilege: partial. The field's best secrets default. Secrets "are only available to setup scripts. For security reasons, secrets are removed before the agent phase starts." Agent internet access is off by default; when enabled it can be restricted to a domain allowlist with methods limited to GET, HEAD, and OPTIONS, and "all outbound internet traffic passes through" a proxy. Gaps: environment variables persist through the agent phase, and the repo checkout credential's handling is unstated.

The rest. Partial across the board, except provenance. One fresh container per task, but Business and Enterprise "caches are shared across all users who have access to the environment." The flow ends with a human opening the PR; nothing stops the requester from approving it. The pinned codex-universal image and version pinning are real reproducibility primitives without an encoded change process. On dependencies, the docs name "downloading malware or vulnerable dependencies" as a risk and offer the domain allowlist as the mitigation; there is no package-identity, package-age, or publisher check, so the cell is undocumented against this property's bar.

Google Jules: per-task VMs, and almost nothing else in writing

Source: launch post and environment docs.

The strongest documented point: "Jules runs each task inside a secure, short-lived virtual machine," it "doesn't train on your private code, and your data stays isolated within the execution environment." That meets the one-environment-per-task bar. Residency does not follow: "worldwide, everywhere where the Gemini model is available" describes model availability, not where code runs.

Everything else is silence or softness. The collected Jules docs contain no statement about secrets handling, credential placement, or network egress at all. Commit identity is never mentioned. The plan-and-diff workflow puts a human at both ends, modifiable "before, during, and after execution," but nothing is enforced and nothing stops the requester from being the sole approver. "Run and Snapshot" captures a validated environment for reuse, unversioned. Dependency provenance: nothing.

Cursor cloud agents: strong cryptographic identity, permissive defaults

Source: cloud agent docs and its security and network page.

Attribution: partial. "Cloud Agents sign every commit with a HSM-backed Ed25519 key," Verified on GitHub and GitLab "so your team can confirm the commit came from Cursor." That nails AI-versus-human distinguishability and misses the binding: no documented link from the commit to the human who launched the run.

Audit trail: partial. Every run stores conversation history, prompts, model responses, tool calls, and artifacts, kept indefinitely by default with Enterprise retention caps and a Delete Agent API. No audit-shaped query interface across runs, no append-only guarantee.

Least privilege: partial. The defaults run against the bar. The docs state that "the agent auto-runs all terminal commands" and "has internet access by default," and name the consequence themselves: "auto-running introduces data exfiltration risk." Runtime Secrets are redacted from transcripts but "still function internally as environment variables." The tightening controls are well documented, three egress modes down to allowlist-only, an Enterprise lock, a git egress proxy on published stable IPs, but safe is opt-in. All of it is domain-level, so dependency provenance stays undocumented.

One documented hazard worth quoting: "If you include .env.local files during snapshot creation, they will be saved." That is the freeze-credentials-into-an-image failure a snapshot scrub gate exists to prevent, described as shipping behavior. Segregation of duties is fully undocumented: "merge-ready PRs," no approval rules.

Anthropic Managed Agents: the substrate, not the compliance product

Source: Scaling Managed Agents. An architecture article, so its silences are scope, not omission from security docs.

Least privilege: ✅. Stated as design intent: "make sure the tokens are never reachable from the sandbox where Claude's generated code runs," via per-repository Git tokens used once at init and wired into the remote, and vault-held MCP tokens fetched by a session-keyed proxy so "the harness is never made aware of any credentials."

Audit trail: partial. The right primitive without the auditor's interface. The session is "the append-only log of everything that happened," durable outside the containers, replayable via wake(sessionId). But getEvents() exists for the brain to resume work; per-actor and per-time-window querying, retention, and access control are not described.

Attribution, gates, and residency never come up. Containers are cattle re-provisioned from "a standard recipe," which is reproducibility's partial. Dependency provenance: out of scope entirely.

Shopify River / Aquifer: documents the architecture, not the compliance

Source: Shopify River / Aquifer (Shopify Engineering, May 28, 2026). An engineering narrative, so its silences are scope, not omission from security docs.

Audit trail: partial, and the strongest in the field. Each session is "an append-only event log, Postgres-backed," "the canonical truth about what's happened so far," and River runs only in public Slack channels, so every session is a searchable transcript. Two durable records, and no documented per-actor, per-time-window query interface, the same gap as Anthropic's log.

Isolation: partial. "The harness lives outside the sandbox," so "the agent loop is not in the same blast radius as rm -rf," and sandboxes are ephemeral session cells rehydrated from Postgres. Residency is not addressed.

Reproducibility: partial, also the strongest in the field. "Build everything with Nix. Dev environments, CI, production images: one reproducible substrate," and profiles ship as Nix bundles. It lands at partial only because the change process itself, the encoded write-review-approve-ship sequence, is not described as data.

Attribution, least privilege, segregation of duties: partial. PRs are "coauthored" by River, which implies a human of record without a described binding mechanism. A credentials proxy and per-profile "sandbox policy" imply scoping without a stated privilege model. PR review is a separate Aquifer profile from River, which separates authoring from reviewing without a documented self-approval rule.

Dependency provenance: undocumented. Nix gives reproducible builds, which touches provenance indirectly, but the post makes no package-identity or SBOM claim. The widely cited "36% to 77%" merge-rate jump and "1,870 PRs/week" appear only in secondhand writeups and are left out of this grade.

Brex: the principles are stated, the mechanisms are not published

Source: Brex's autonomous agents. A build log, not product docs, so "undocumented" here means "not published," a lower bar of silence.

Two governance principles are stated flat: agent work "needs to be attributed back to an actual human and not just a bot," and "Agents should only have access to the information they need to perform the task at hand." Neither mechanism is described. Each task gets its own RDE (Brex's per-task isolated remote developer environment), and "running 50 in parallel, each iterating independently, requires thinking carefully about orchestration and environment isolation." The loop ends at a human review, with enforcement unpublished. Logging, image versioning, and dependency handling do not appear.

Wallfacer: graded on published documentation, which barely exists

Source: wallfacer.ai.

Every cell in the Wallfacer row is undocumented, and that is the grade the rule produces. Wallfacer has published no security or compliance documentation this corpus could collect: nothing on commit identity, log durability, credential placement, residency, approval enforcement, or image versioning. The detailed architecture in the case study, the two-VM split, the three audit streams, the snapshot scrub gate, came through the sponsor relationship, and a buyer cannot cite a sponsor's private description to an auditor any more than they can cite a sales call. The one cell the sponsor settles directly is property 7: per the case study, Wallfacer ships no dependency-install gating, the same as everyone.

The sponsor's fix is the same as every other vendor's: publish the docs.

The four empty columns are the team-and-auditor properties

Four patterns recur across every row:

• No residency controls. No data residency or placement controls, anywhere.
• No queryable audit API. No auditor-facing, per-actor queryable audit API, even where the underlying log exists.
• No per-human identity. No AI identity scoped to the initiating human, as opposed to one shared bot identity per vendor; Copilot's co-author field is the closest documented approximation.
• No dependency provenance. Every platform treats the package registry as a trusted destination and none treats the package as an untrusted input, which is precisely the channel slopsquatting walks through, since the malicious package is served by the allowlisted host. Copilot's advisory-database check is the lone documented gate, and it detects known-bads only.

The gaps are not random; they cluster on the properties that only matter at team-and-auditor scale. Sandboxing, secrets, and egress, the single-user safety surface, are where vendors compete and document heavily. Residency, queryable audit, per-human identity, enforced gates, and package identity are where the docs go quiet. With this many undocumented cells, some gaps are documentation debt rather than capability gaps. For a buyer under SOC 2 or ISO 42001, the distinction is academic until it is in writing. Run the seven properties as a documentation request, and treat "we do that but haven't written it down" as a no until the writing arrives.