Buy Enterprise if your security review needs SSO, role-based access, or a forced sandbox, because new Teams plans no longer include SSO. On either plan, enforce permission rules, approve MCP servers and third-party agents, decide which models that need provider data retention to allow, and keep sensitive files away from the agent.
When you need this
- Security or compliance must approve the editor before a team rollout.
- Engineers want to connect MCP servers or run third-party agents inside the editor.
- You need SSO, SCIM provisioning, or role-based access.
- Repositories hold secrets, regulated data, or generated code the agent must not read or edit.
Evaluation criteria
Plan fit
Does the plan you will buy include the controls you need?
Look forSSO and role-based access are Enterprise only, and new Teams plans no longer include SSO. MCP and model allowlists and team-enforced Devin Local permission rules are available on Teams and Enterprise. Sandbox enforcement, organization-wide sandbox domains, and the web search control are Enterprise settings.
Agent permissions
Which actions run without approval?
Look forTeam-enforced allow, ask, and deny rules for Devin Local and Devin CLI, which take precedence over user and project configuration. Public reports of the agent deleting files without approval argue for keeping destructive commands on ask or deny.
Sandbox
Is the agent confined to the workspace and approved domains?
Look forDevin Local's operating-system sandbox, with filesystem isolation and domain allowlists and denylists. Enterprise admins can force sandbox mode and set organization-wide domain rules. Restricted Mode turns every agent off in a workspace that is not trusted. Builds before 3.10.31 (Sep 16, 2026) let restricted workspace settings through when written in nested form, a VS Code flaw tracked as CVE-2026-81376, so require 3.10.31 or later.
MCP and third-party agents
Which tools and agents can engineers connect?
Look forSet an MCP allowlist. Adding one server blocks all others. Enforce a registry if required. Devin Local asks before every MCP call by default. ACP agents such as Codex CLI use their provider's terms and billing, so approve them separately. A team ACP registry distributes the approved set to members.
Models and retention
Which models can process your code, and under what retention?
Look forA model allowlist by model or by provider. Some Anthropic and OpenAI models require the provider to keep data for up to 30 days for trust and safety checks. A Teams or Enterprise admin must enable them before anyone can use them.
Files the agent can see
What is excluded from indexing and agent access?
Look forUse .devinignore to remove paths from indexing and block the agent from viewing, editing, or creating them. The agent also cannot edit files matched by .gitignore. A global .codeiumignore applies to every workspace on a machine.
Identity and devices
How are users provisioned and machines locked down?
Look forSAML SSO and SCIM with Okta, Microsoft Entra ID, Google Workspace, or another SAML provider on Enterprise. SCIM assigns groups, and roles are set in the admin portal. Device policies fix the extension allowlist, update mode, and telemetry level before anyone signs in.
Questions to ask vendors
- What does Cognition retain for our plan, and which model choices change that?
- Can we force the sandbox for every member, and how do commands that need network access get approved?
- Which legacy terminal allow and deny lists still act as the fallback until our Devin Local permission policy is written?
- How do we govern third-party ACP agents whose terms and billing sit outside our Cognition contract?
- Can conversation and Codemap sharing be turned off for the whole organization?
Red flags
- A Teams purchase made on the assumption that it includes SSO.
- MCP turned on with no allowlist or registry.
- Models that require provider data retention enabled without a security decision.
- No .devinignore for secrets and generated code in repositories the agent can reach.
Products in this piece
Sources
- Official documentation
- 10
- Public source
- 3
- Devin Desktop docs: Admin controls reference
- Devin Desktop docs: Devin Local agent
- Devin Desktop docs: Terminal
- Devin Desktop docs: Quota-based usage
- Devin Desktop docs: SSO and SCIM
- Devin Desktop docs: Role-based access
- Devin Desktop docs: Agent Client Protocol
- Devin Desktop docs: .devinignore
- Devin Desktop docs: Enterprise policies
- Devin docs: Self-serve plans
- Hacker News comment by badaigent on the agent deleting files without approval (Jul 27, 2025)
- Hacker News comment by powerapple on Windsurf installing packages globally (May 12, 2025)
- Hacker News comment by sensanaty on reviewing every agent command (Mar 6, 2026)