Skip to main content

Buyer guide

Devin Desktop Workflow Playbook: Rules, Permissions, and Review for Agent Work

Set committed rules, permission scopes, task size, and verification so Devin Local changes arrive tested and spend stays visible.

Reading time
3 min read
Sources
13 cited

Commit the agent's rules to the repository, set Devin Local's permission scopes, and run the tests on every agent diff before merge. Those steps, plus sizing tasks the agent can finish, decide whether multi-file work from Devin Desktop arrives as clean, tested changes.

When you need this

  • Engineers are moving from completions to delegating multi-file changes to Devin Local.
  • Results vary by engineer because project conventions live in people's heads and outside the repository.
  • Agent diffs reach pull requests before anyone has run the tests locally.
  • Your team still relies on Cascade memories or workflows, which Devin Local does not support.

Evaluation criteria

  1. Rules in the repository

    Where do the agent's instructions live, and who maintains them?

    Look forCommit rules in .devin/rules or AGENTS.md. The editor still reads .windsurf/rules. Each workspace rule file allows 12,000 characters. Devin Local does not read Cascade memories, so migrate required ones with the Cascade Migration Wizard. One developer uses .windsurfrules to keep the agent within the conventions of a niche Elixir stack.

  2. Permission scopes

    What can the agent run, read, and fetch without asking?

    Look forSet Devin Local permission rules for file reads and writes, commands, HTTP fetches, and MCP tools. Every MCP tool call defaults to ask. Teams and Enterprise admins can enforce rules members cannot override. Keep package installs on ask. One public account reports Windsurf installing packages into a global Python environment.

  3. Task size

    Which tasks go to the agent, and which stay with the engineer?

    Look forGive Devin Local defined work with explicit success criteria. An engineer whose team moved from Copilot to Windsurf mainly asks it questions about a monorepo of just over 1M lines. The engineer almost never hands it complex tasks, because describing one takes nearly as long as writing it. Use Plan mode to approve the approach in a file before edits begin.

  4. Isolation

    Can the agent work without touching an engineer's main checkout?

    Look forRun each Devin Local session in its own git worktree. Merge it after the checks pass so parallel sessions do not edit the same working copy.

  5. Verification

    What runs before a change leaves the engineer's machine?

    Look forRun Quick Review, then the project's tests. Quick Review sends a second agent over Devin Local changes, and its SWE-check model is free on every plan. A reviewer of Devin Local after the rename warns not to assume it ran the tests after a refactor. Another developer reports the agent reintroducing fixed bugs two or three times in one project.

  6. Model choice and spend

    Which models does the team use for routine work?

    Look forQuota draws down per token at each model's rate. Cognition recommends the lower-cost SWE models for routine tasks, and one frontier model for the length of a task so requests benefit from caching. The analytics API reports the agent lines each team accepted.

Questions to ask vendors

  1. Which of our Cascade memories and workflows will the Migration Wizard convert to skills, and which need rewriting by hand?
  2. Which allow, ask, and deny rules can we enforce for every member from team settings, and which can engineers loosen locally?
  3. Which Quick Review models can we restrict, and what does a frontier-model review draw against our quota?
  4. How do we report accepted agent lines per team through the analytics API?
  5. Which Cascade conversations still need the Continue in Devin Local prompt?

Red flags

  • Instructions kept in personal memories and absent from committed rules.
  • MCP tools or package installs set to always allow before anyone has reviewed what they reach.
  • Agent diffs merged on the strength of the agent's own summary, without the tests run.
  • Frontier models used for every routine task, with no one watching quota draw.

Products in this piece

Sources

Official documentation
8
Public source
5
  1. Devin Desktop docs: Devin Local agentOfficial documentationdocs.devin.ai
  2. Devin Desktop docs: Memories and rulesOfficial documentationdocs.devin.ai
  3. Devin Desktop docs: AGENTS.mdOfficial documentationdocs.devin.ai
  4. Devin Desktop docs: WorktreesOfficial documentationdocs.devin.ai
  5. Devin Desktop docs: Quick ReviewOfficial documentationdocs.devin.ai
  6. Devin Desktop docs: Quota-based usageOfficial documentationdocs.devin.ai
  7. Devin Desktop docs: Admin controls referenceOfficial documentationdocs.devin.ai
  8. Devin Desktop docs: Get agent output (lines of code)Official documentationdocs.devin.ai
  9. Hacker News comment by gcbirzan on using Windsurf for questions about a 1M-line monorepo (Dec 14, 2025)Public sourcenews.ycombinator.com
  10. Maksim Danilchenko: Devin Desktop (ex-Windsurf): Features, Pricing, What Changed (Jun 6, 2026)Public sourcedanilchenko.dev
  11. Søren Kottal: Vibe coding a nifty Umbraco tool (Mar 16, 2025)Public sourcedev.to
  12. Daniel Bergholz: My AI-Powered Workflow for Writing Elixir and Phoenix with Windsurf (Mar 10, 2025)Public sourcedev.to
  13. Hacker News comment by powerapple on Windsurf installing packages globally (May 12, 2025)Public sourcenews.ycombinator.com