Key concepts

An agent's change has three possible actors: the developer who asked, the agent's own app identity, and whoever set up the automation that started it. GitHub records its agent as the commit author, with the requester as co-author and a link to the session log; an automation's pull request is credited to whoever created the automation. Locally, agents mostly run as the developer, with the developer's tokens, so the audit log can't tell "the developer typed it" from "the agent did it with the developer's token". Payment-card rules now ask for the agent to have its own credentials (see How the rules work).

The law adds an author. Under US copyright only a human can be one: the US Copyright Office said in January 2025 that prompts alone don't make you an author, and the Supreme Court declined to hear Thaler's appeal on March 2, 2026. The Linux kernel lets agents add an "Assisted-by:" tag and forbids them from signing off a change, so a human stays responsible.

A plan tier is an identity too. The same tool trains on your code or not depending on the account: GitHub Copilot's Free, Pro and Pro+ plans have used interaction data for training by default since April 24, 2026 unless the user opts out, while Business and Enterprise are excluded. A developer signing in with a personal account on company code is the classic leak.

Several state machines run at once.

• Task: queued, running, waiting for input, pull request open, changes requested, merged or abandoned. On GitHub, moving a draft to "ready for review" is a human step the agent can't take.
• Pull request: opened, CI running, reviewed, merged or closed. Agent pull requests stall waiting for review and get abandoned, so I'd count abandoned ones as waste.
• Session: capped by the clock (59 minutes on Copilot), which forces work that can resume.
• Billing: trial, active, paused at a limit, overage on, downgraded. When GitHub credits run out and overage is off, Copilot pauses until the next cycle. Anthropic's and OpenAI's individual plans add rolling five-hour and weekly windows on top.

Git history and pull request records are what auditors test for change management. The session log is another ledger, one that may hold code and secrets, so who keeps it and for how long matters for audits and retention. Cursor's Origin is an agent vendor trying to own the main ledger itself.

An agent's rules live in three places, and only two of them enforce anything.

Cursor's Bugbot reads its configuration from the base branch, so a pull request can't change how Bugbot reviews it. That's the pattern I'd copy for any gate: keep it out of reach of the change under review.

Company policy sits above them: approved tools and plan tiers, which data may enter a prompt, dependency rules, reviewer independence, the line between prototype and production, and spending limits (GitHub sets budgets down to the user; Kiro keeps overage off by default for enterprises).

Dates I'd keep on a calendar as of October 2026:

Configuration is dated too: Cursor's cloud agents get their secrets at start, and an MCP tool definition can change after you approved it. And promotions end on dates that users read as price rises: GitHub's extra credits stopped on September 1, 2026.

Git and the pull request are the universal hand-off, and GitHub Actions is the closest thing to a standard CI interface (Cursor's Origin runs Actions workflows). AGENTS.md, a plain file of instructions for agents stewarded by the Agentic AI Foundation under the Linux Foundation, says more than 60,000 open-source projects use it, and Codex, Jules, Gemini CLI, Copilot, Cursor and Devin all read it; Claude Code reads its own CLAUDE.md, and AGENTS.md if present. MCP, the protocol agents use to reach tools, is covered in AI agents: orchestration platforms.

One company can sit in many of these roles. Microsoft owns GitHub, Copilot, Advanced Security, npm and Azure, writes the indemnity, trains its own coding model and offers both OpenAI's and Anthropic's models in Copilot. Google sells Gemini Code Assist, Antigravity and Jules, and owns Wiz and Mandiant. Amazon sells Kiro, runs AWS and invests in Anthropic. Every scanner or bot in CI is also one more token holder: a poisoned scanner, Trivy, became the way into other companies' pipelines in March 2026 (see Cloud security (CNAPP)).

Agents leave the change-management rules as they were and change who counts as the author.

For a regulated platform the answer is the same in both places: the reviewer and the approver must be people other than the author, the change record has to show who did what, and the manufacturer answers for the product whoever wrote the code.

Vendor terms push the operational risk down. Cursor's individual terms make the user "solely responsible" for suggestions it runs automatically and cap its liability at the greater of six months' fees or $100; its enterprise agreement, Anthropic's commercial terms and AWS's customer agreement cap at 12 months of fees, with IP indemnities outside the cap. GitHub's indemnity covers unmodified suggestions with the public-code filter on, and almost no shipped code is unmodified, so it covers the snippet more than the product.

When an agent did real damage, the platforms paid in goodwill: Replit promised a refund and added a default split between development and production databases. Insurers are moving the other way, with generative-AI exclusions entering general liability forms in 2026 (more in AI agents: orchestration platforms).