Amp Data, Permissions, and Orbs Checklist

Look forAmp runs tools without asking for approval. A plugin's tool.call handler can allow, reject, or modify each call. Workspace admins can distribute it globally. amp.mcpPermissions filters MCP servers by pattern, and Enterprise admins can enforce an approved registry.

Look forAmp says its client and server do not index the entire codebase. Files used as context go to model providers and stay with the thread on Google Cloud in the US. Orbs clone the repository into an encrypted e2b sandbox until the thread is deleted. Workspace threads are shared by default, and admins can see private threads.

Look forMinimal Data Retention applies to Amp-managed provider connections, with abuse-monitoring and model exceptions. Amp and its providers do not train on customer data unless you opt in. Enterprise workspaces cannot enable training. Your keys and linked subscriptions follow the provider account's terms.

Look forEnterprise admins can disable models, grant models to directory groups, and forbid personal model provider keys. Amp locks models that a built-in mode uses until admins pin another model for that role. Inference runs on Anthropic, OpenAI, Google, and other US-based providers listed in the security reference.

Look forMatch identity controls to the required plan. SAML or OIDC SSO needs at least one Megawatt or Gigawatt workspace member, or Enterprise. Enterprise adds SCIM directory sync, admin roles, passkey enforcement, and authentication audit logs. IP allowlisting is available on request for an extra charge, and Enterprise customers can request application audit logs. Amp is SOC 2 Type II and offers no self-hosted deployment.

Look forOrbs mint short-lived OIDC tokens scoped to the workspace, project, user, and thread. A cloud provider can grant temporary access. Amp hides secret values in orb output and records who created or changed each secret. Prefer OIDC to stored tokens and grant production access per thread.