Govern Coding Agents Across Teams

Coding agents arrive bottom-up. An engineer enables Copilot, another runs Cursor, a third wires Claude Code into a workflow. Each one works in a repository. Within a quarter the organization has hundreds of agent actions a week, spread across teams and repos, and nobody can enumerate them.

Modulo is the control plane for that spread. Policy, access, approval, and the record live in one place, above the tools the agents already use.

Who can do what

Modulo combines organization roles with per-team roles. Teams own their pipelines; roles decide who creates pipelines, who approves changes, who reads the audit log, and who edits governance policy.

Identity comes from your existing provider. Modulo supports single sign-on over OpenID Connect (OIDC) and SAML 2.0, with first-login provisioning, and SCIM 2.0 for user and group lifecycle. SCIM groups map to Modulo teams with a team role, so membership follows your directory rather than a second admin list. See Single Sign-On and SCIM Provisioning.

What each agent can touch

Every agent carries a capability scope: which repositories it may reach, which actions it may take, and which environments it may target. Connector credentials are scoped to a repository and encrypted at rest, then decrypted once at run start into a run-scoped context that never reaches logs or spans. See Connectors and Secrets.

Capability scopes are what keep a triage agent that reads issues from also holding merge rights.

Where humans approve

Human-in-the-loop (HITL) gates sit between an agent's output and the next step. A gate can require review on every write, on a defined change class, or on each action, and a human_only gate cannot be auto-approved. The reviewer sees the artifact, the prompt that produced it, and the upstream agent outputs before deciding.

Autonomy is set per pipeline or per node as manual approval, notify on complete, or fully autonomous. You choose the level, and eval scores give you the evidence for moving a pipeline up. Per-agent token budgets, a pipeline spend circuit breaker, and an admin-only org-wide pause keep that autonomy bounded. See Human-in-the-Loop and Evals.

One record across teams

Every run writes to a single hash-chained, append-only audit log in your own database, with a versioned snapshot per run. Per-run token spend is attributed to the team that owns the pipeline, so budget and evidence come from the same source. See Cost Management.

Across the toolchain

The same pipeline can govern work in GitHub, GitLab, Bitbucket, Gitea, or Azure Repos, and chain into Jira, Linear, or Notion. Governance does not change when a team changes source host.

Where to go next

• Connectors: repository and tool integrations
• Triggers: webhook, cron, polling, and agent-signal entry points
• Audit Trail for AI-Generated Code: the evidence layer in detail