Augment Code Enterprise Security for Engineering Teams
Augment Code gives engineers a Context Engine, a coding agent, a CLI and MCP and native tools, with an Enterprise plan that adds SSO, SCIM and customer-managed keys. This page reads what the vendor publishes, shows where each control stops, and says when a team needs a second one.
Direct answer
Augment Code enterprise security rests on a SOC 2 Type II attestation, ISO/IEC 42001 certification, a stated policy of never training on customer proprietary data, customer-managed encryption keys, and on the Enterprise plan SSO, OIDC and SCIM. Those controls decide who signs in and how the vendor handles your data. They do not judge whether one agent tool call, such as a deploy or a ticket write through an MCP server, should proceed, so high-impact actions need a separate approval step.
Try it live
Watch AgentShield block an attack in real time.
Pick a scenario and drive the inspection lane yourself. No signup needed.
Run a request
Runs the live engine on your text. Nothing is stored, no account needed.
Inspection lane
INSPECTINGPolicy trace
High-risk action held for approval
Audit trail
- § · → → →
The risk
A platform team moves sixty engineers onto Augment Code and connects the agent to an MCP server that reaches the ticket system and a deploy API. An engineer asks it to triage a failing release. It reads an issue comment containing hostile text and calls the deploy tool with a changed target. The vendor is SOC 2 attested, nothing was trained on the code, and sign-in ran through the company identity provider. Nobody decided that this particular call was wrong.
How AgentShield handles it
Start with the vendor controls for identity, encryption and data handling, because they cover who uses the tool and what the vendor does with your code. Then route agent calls that reach systems of record through an AgentShield gateway. Rules check the arguments of each call, hold deploys, permission changes and bulk writes for a named approver, and write one attributed record of what was allowed, denied and approved.
The controls
The controls that secure which repositories, tools and deploy actions an Augment Code agent may touch, and which wait for a named approver.
What Augment Code publishes about security
The honest summary is that Augment documents a strong vendor compliance and data handling posture, and says little about what the agent may do once it holds tools. The facts below come from the Augment Code pricing page and its security page, read on November 12, 2026. Check the current pages and ask for the reports in writing before you sign.
| Control | What the vendor pages say | Where it stops |
|---|---|---|
| Attestation | SOC 2 Type II attested, and an ISO/IEC 42001 certified AI management system | Covers the vendor's operations, not your agent's behavior |
| Training | The security page says it never trains on customer proprietary data | A privacy commitment, not a limit on actions |
| Encryption | Customer-managed encryption keys are listed, with Enterprise as the plan that names CMEK | Protects stored data, not tool calls |
| Identity | Enterprise lists SSO, OIDC and SCIM | Decides who signs in, not what a session does |
| Audit | The pricing comparison lists audit trails and SIEM integration, but the security page does not describe audit logs | Ask what an audit record contains for a tool call |
| Agent tools | Plans include a coding agent, a CLI, and MCP and native tools | The tools it reaches are the ones you connect |
The pricing page does not break down which security items belong to Standard, Business and Enterprise, and it does not state a data retention period. Ask for both in writing.
Where Augment Code controls stop
None of these gaps is unique to Augment. They are the usual shape of a vendor control: it is decided before the agent reads the specific text that will steer it.
| Gap | Why it matters in a rollout |
|---|---|
| The agent acts with the credentials of the engineer and the MCP servers you connect | One broad token is handed to every step |
| Issues, logs and code comments are untrusted input | The agent reads them to do the job, and so can an attacker who writes to them |
| A compliance report is not a runtime control | SOC 2 says the vendor runs a controlled service, not that your agent's deploy call is correct |
| Usage dashboards are not an approval record | An auditor asks who approved a production change, which usage analytics cannot show |
The same questions apply to the other agents your engineers may run, covered on Cline enterprise security, Devin security, Gemini Code Assist enterprise security and the wider coding agents page.
Augment Code security checklist for US platform and security teams
- Request the SOC 2 Type II report and the ISO/IEC 42001 certificate, and read the exceptions.
- Confirm in the contract that no customer code is used for training, and ask for the retention period.
- Decide which plan you need. Standard and Business cap at 50 seats, so Enterprise is the one with SSO, SCIM and CMEK named.
- Connect SSO and SCIM so leavers lose access the same day.
- List every MCP server and native tool the agent may reach, and give each least privilege credentials.
- Run a pilot, record which calls the agent actually makes, and write rules from that list.
Steps one to five cost administration time. Step six needs a mechanism, and it is where teams look for a second control. Plan prices are on Augment Code pricing.
Where a second control earns its place
An AgentShield gateway sits on the paths your agents use to reach systems of record, such as a deploy API, a ticket system, a database tool or a payment service. It does not replace Augment controls. It adds a decision on each action, outside the model and outside the editor.
| Risk | Augment control | Second control |
|---|---|---|
| Wrong people use the tool | SSO, OIDC and SCIM on Enterprise | None needed. Use the platform |
| Vendor mishandles your code | SOC 2 Type II, no training, CMEK | None needed. Read the reports |
| Injected text steers a tool call | Credential scoping, if you set it up | Rule on the target and arguments, held for a named approver |
| Agent calls a billing, identity or deploy API | Scoped keys, if you set them up | Count and amount limits per run and per day, approval above them |
| Customer data leaves in a tool call | None documented | Content scan on outbound arguments |
| Proof for a customer security review | Audit trails, scope not described | One attributed record of allowed, denied and approved actions |
The gateway works for calls you route through it, such as internal APIs and tools reached through an MCP endpoint. It cannot see actions that stay inside the editor, so least privilege credentials remain your control there. The mechanics are on tool permissions and the approval flow on human in the loop AI agents.
When to buy nothing, use Augment controls, or add AgentShield
| Your situation | What to do |
|---|---|
| A small team uses completions and chat only | Buy nothing beyond the Augment plan. Keep agent tools off or read-only |
| You need SSO, SCIM and customer-managed keys | Use the Enterprise plan |
| Procurement wants attestation | Use the SOC 2 report and the vendor security page |
| The agent calls billing, identity, deploy or customer data tools | Add argument rules and approval on those calls |
| An auditor wants proof of who approved what | Add the gateway record |
Three of five rows end without a purchase from us. That is deliberate, because a control you do not need is not worth selling.
FAQ
Common questions about augment code enterprise security.
Is Augment Code secure for enterprise use?
Augment lists a SOC 2 Type II attestation, an ISO/IEC 42001 certified management system, customer-managed encryption keys and a policy of never training on customer proprietary data. Those cover the vendor. They do not decide whether one agent tool call should run, so high-impact actions need a separate control.
Is Augment Code SOC 2 compliant?
Augment states that its service is backed by SOC 2 Type II and lists the attestation on its security page. Request the report under NDA and read the scope and exceptions yourself, since an attestation covers the vendor operations, not how your own agents use tools.
Does Augment Code train on my code?
The security page says Augment never trains on its customers proprietary data, and the pricing page repeats no AI training on your data for each plan. Put that commitment in your contract and ask for the retention period, which the pricing page does not state.
How much does Augment Code cost?
The pricing page lists Standard at $20 a month and Business at $100 a month, each with the same amount in included usage and up to 50 seats, and Enterprise on custom pricing. Usage beyond the included amount is billed pay as you go. Confirm current terms with Augment.
Can an Augment Code agent be hijacked by prompt injection?
Any agent that reads issues, logs, code comments or web pages can be steered by hostile text in them. Narrow credentials limit what it can reach, but an approved call can still be misused. Rules on tool call arguments, with approval for risky actions, limit the damage when the model is fooled.
Does AgentShield work with Augment Code?
Yes, for tool and API calls routed through a gateway endpoint, such as internal APIs and MCP servers the agent uses, where it checks the arguments of each call and holds risky ones for approval. It does not replace Augment controls and cannot see activity that stays inside the editor.
More use cases