Why Enterprises Hesitate to Use Cloud-Hosted Coding Agents
AI coding agents can write code, run commands and interact with development environments. But for an enterprise, the question is not simply, “Can the agent code?”
The bigger question is: Where does that work happen, and what can the agent access?
With a traditional cloud-hosted model, the agent’s execution environment is managed by the provider. That can create concerns for organizations handling sensitive source code, credentials and customer information.
Source-Code Residency Concerns
Source code can be one of a company’s most valuable assets. Enterprises may have requirements about where proprietary code and related data can be processed.
This becomes especially important for organizations operating under strict security or data-residency requirements.
Credential and Secret Exposure
Coding agents may need access to repositories, package registries, internal services and other development resources.
If those credentials are exposed to an uncontrolled environment, the consequences can be serious. Enterprises therefore want credentials and sensitive execution to remain within infrastructure they control.
Customer-Data Protection
Development environments can also contain customer information or other sensitive business data.
Keeping execution inside the enterprise environment gives security teams greater control over where that information can be accessed and processed.
Keeping Execution Inside the Enterprise Perimeter
This is the basic idea behind Agent Relay: keep the agent experience while moving its execution into infrastructure controlled by the enterprise.
For the Cursor integration, Coder Agent Relay connects cloud-hosted agent sessions to self-hosted Coder workspaces. The agent’s orchestration and AI inference remain cloud-hosted, while its tool calls execute inside the Coder workspace.
Coder Workspaces as the Execution Boundary
Think of the Coder workspace as a controlled room where the agent is allowed to work.
With Agent Relay, each Cursor agent session can receive an ephemeral Coder workspace. The workspace can be provisioned using enterprise-defined templates and networking policies, then removed when the session ends.
| Enterprise Concern | Self-Hosted Execution Approach |
|---|---|
| Source code | Runs inside controlled workspaces |
| Network access | Governed by enterprise policies |
| Agent activity | Auditable through workspace controls |
| User attribution | Connected to the initiating user |
| Execution environment | Customer-controlled infrastructure |
Role-Based Access Control (RBAC)
RBAC provides a way to decide who can access what.
Instead of giving every developer or agent broad permissions, enterprises can apply permissions through their existing identity and workspace governance model.
The goal is simple: an agent should have only the access required for the task it is performing.
Agent Firewall
An autonomous agent can potentially make many network requests while completing a task. That makes network controls particularly important.
Coder’s Agent Firewall is designed to restrict and audit what autonomous programs can access. It can enforce network policies and allow or block requests based on configured rules.
This creates an important security boundary: the agent does not get to decide its own network permissions.
Audit Logging
Security teams need more than prevention. They also need visibility.
Agent Relay’s architecture provides logs connecting the Cursor session and user to the Coder workspace. Agent Firewall can also produce audit records showing whether network requests were allowed or denied.
That gives security teams a clearer record of agent activity.
Human-to-Agent Identity Mapping
An autonomous agent still needs human accountability.
Agent Relay connects the agent activity back to the user who initiated the session. This helps answer a basic security question:
“Which person was responsible for this agent’s activity?”
This identity mapping makes it easier to correlate agent activity with the human developer who requested it.
Tracking What an Agent Accessed and Executed
Enterprise governance becomes much stronger when teams can determine what an agent actually did.
Relevant records can include:
- Which workspace handled the task
- Which user initiated it
- Which network requests were permitted or blocked
- Which resources the agent attempted to reach
- What happened during the agent session
This makes the difference between simply running an AI agent and governing an AI agent.
Controlling Which Resources Agents Can Reach
Self-hosting does not mean giving an agent unrestricted access to the internal network.
Enterprise teams can define the resources that an agent is permitted to reach through workspace networking and Agent Firewall policies.
The idea is similar to giving an employee a security badge: the badge opens the doors they need, not every door in the building.
Governance of Autonomous Coding Agents
As coding agents become more autonomous, governance needs to cover more than traditional developer access.
Enterprises need visibility into:
- Who initiated an agent session
- Which workspace it used
- What resources it could reach
- What network activity was permitted or blocked
- What records are available for auditing
Agent Relay applies these controls through the Coder workspace and governance layer rather than creating a completely separate security model for agent activity.
Implications for Regulated Industries
For regulated organizations, the location of execution can be just as important as the AI model itself.
Banks, healthcare organizations, government agencies and other highly regulated enterprises may need tighter control over source code, credentials, data access and network connectivity.
Self-hosted execution gives these organizations a way to place the agent’s working environment inside infrastructure they control.
How Self-Hosted Execution Changes the Enterprise Risk Model
The key change is where responsibility and control sit.
| Traditional Cloud-Hosted Execution | Self-Hosted Execution |
|---|---|
| Provider controls execution environment | Enterprise controls execution environment |
| Agent activity may be outside the enterprise perimeter | Agent tool execution occurs inside controlled workspaces |
| Network controls depend heavily on provider | Enterprise can define workspace and network policies |
| Governance can be separated from development infrastructure | Governance can be applied through the workspace layer |
However, self-hosting also means the enterprise takes greater responsibility for securing and governing that infrastructure.
What Agent Relay Does Not Mean From a Security Perspective
Agent Relay should not be interpreted as making the entire AI system self-hosted.
For the Cursor integration, agent orchestration and AI inference remain cloud-hosted. The worker inside the Coder workspace executes the agent’s tool calls.
So security teams still need to understand the complete data flow and determine what information reaches the cloud-hosted agent provider.
Self-hosted execution also does not mean prompt injection and other agent risks simply disappear. Network and workspace controls provide an additional security boundary, but enterprises still need appropriate governance.
Questions Security Teams Should Ask Before Deploying It
Before deployment, security teams should ask:
- Where exactly does source code execute?
- What information is sent to the cloud-hosted agent provider?
- Where are credentials and secrets stored?
- Which internal resources can an agent access?
- Can network access be restricted with allowlists?
- Can every agent session be mapped to a human user?
- What activity is recorded in audit logs?
- How long are those records retained?
- Can access be quickly revoked?
- Does the architecture satisfy the organization’s regulatory and data-residency requirements?
Final Takeaway
Coder Agent Relay changes the enterprise conversation around AI coding agents from “Should we trust a cloud agent?” to a more practical question: “Where should the agent execute, and what controls should surround it?”
By connecting cloud-hosted agent sessions to self-hosted Coder workspaces, Agent Relay gives enterprises greater control over execution, networking, identity and auditing while retaining the cloud agent experience developers already use.