Devin & Cognition Hardening Guide

AI/ML Platform Last updated: 2026-11-05

Cognition common controls and Devin Cloud hardening: SSO, SCIM, roles, API credentials, security profiles, repository access, secrets, and audit evidence.

Product Docs API Docs

Code Packs: Terraform API Scripts CLI Scripts Config

View:

Cognition — Requirements Cheat Sheet

All controls condensed. Click any requirement to jump to full implementation details.

Requirement	Description	Rationale

Overview

Devin is Cognition’s software-engineering agent. Its ability to execute commands, use connected repositories and call external tools makes identity, authorization and execution boundaries more important than prompt instructions alone. This is the Cognition Common Controls hub, centered on the Devin Cloud organization/enterprise control plane. Product-specific local execution and knowledge-access controls live in the linked guides.

Intended Audience

Enterprise identity and security administrators
Platform engineers governing autonomous coding and integrations
GRC teams collecting configuration evidence

How to Use This Guide

L1 (Crawl): Establish ownership, least privilege and monitoring.
L2 (Walk): Enforce lifecycle, network and integration boundaries.
L3 (Run): Separate execution infrastructure and sensitive-data workflows.
Test changes in a non-production organization first. Before authentication or inbound-network changes, prove an independent administrative recovery path; otherwise do not apply.

Scope

Cognition is the owner/platform; Devin Cloud, Devin CLI, Devin Desktop and DeepWiki are distinct surfaces. Desktop succeeds acquired Windsurf; it is included for current Cognition coverage, not described as originally created by Cognition. Devin Security, Review, Oncall and Outposts are capabilities/deployment surfaces, not additional duplicate product guides. See the source and automation census.

These enterprise controls do not automatically configure local CLI/Desktop permissions, public DeepWiki, or Outpost firewalls. Cloud-backed Outposts are not a fully air-gapped deployment. The separately administered Devin Federal / air-gapped guide covers its own portal and host policies; these commercial settings do not configure it. Poke has a separate account and integration plane. Windsurf Plugins are covered conditionally in the Desktop guide. The November source-first ledger records bounded exclusions and unverified acquired-product surfaces.

Validation: Documentation-backed draft; local structural and mocked pack tests are not tenant validation. No live console, API credential, provider plan/apply or OCEAN run was exercised. All guides remain ai-drafted.

Products in This Platform

Product	Guide	Control-plane boundary
Common Controls / Devin Cloud	This guide	Enterprise and organization identity, cloud agent governance and evidence
Devin CLI	Devin CLI	Local permissions, sandbox and managed client controls; cloud profiles do not replace these
Devin Desktop (formerly Windsurf)	Devin Desktop	IDE policies and Cascade; Devin Local follows CLI controls instead
DeepWiki	DeepWiki	Public documentation/MCP versus private Devin indexing and authenticated access
Poke	Poke	Separate personal messaging, integration, recipe, API and tunnel identity; does not inherit Devin SSO
Devin Federal / air-gapped	Devin Federal	Separate federal portal and offline host policy; commercial common controls do not configure it

Identity & Credentials
Network & Execution Boundaries
Repositories, Tools & Secrets
Monitoring & Detection
Compliance Quick Reference

1. Identity & Credentials

Profile Level: L1 (Crawl)

Framework	Control
NIST SP 800-53 Rev. 5	IA-2, AC-3

Description

Require the enterprise identity provider and its phishing-resistant MFA policy; do not mistake an SSO connection for enforcement.

Rationale

Why This Matters:

Alternate login routes undermine centralized authentication.
Existing membership and sessions require separate lifecycle handling.

Attack Prevented: Account takeover through a weaker sign-in route.

Prerequisites

Enterprise; self-service SAML/OIDC configuration and identity-provider administrator. Prove a recovery path before changing authentication.

ClickOps Implementation

Open Settings → Authentication. Verify the work domain using the displayed _devin-verification DNS TXT record and Check DNS; create the supported SAML/OIDC application at your IdP.
Select Add SSO connection, configure the confirmed metadata/credentials and verified domains, then test with a pilot administrator. Apply MFA at the IdP.
Under Sign-in methods, disable weaker email, Google and GitHub methods after proving recovery. At least one method must remain enabled; the current method cannot be disabled. Adding SSO alone does not enforce it.
Inspect Edit connection → Add members automatically (default on). Disable automatic membership if access must require provisioning; deprovisioning and existing sessions still need lifecycle controls.

Automation: The current SSO guide documents self-service ClickOps. No connection/sign-in-policy writer was established in the fetched provider and API references; a complete current OpenAPI export remained unavailable, so unlisted interfaces are unverified. Membership APIs do not enforce SSO. Current procedure, retrieved 2026-11-05.

Validation & Testing

Use a pilot account to verify IdP authentication and rejection through each disabled alternative. Test the independent recovery route; record results without credentials.

Compliance Mappings

Framework	Control	Mapping intent
NIST SP 800-53 Rev. 5	IA-2, AC-3	Supports the mapped access, configuration or monitoring objective; not a certification claim

Source: SSO onboarding (verified 2026-10-29).

1.2 Automate Deprovisioning with SCIM

Profile Level: L2 (Walk)

Framework	Control
NIST SP 800-53 Rev. 5	AC-2

Description

Use SCIM for user/group lifecycle and disable conflicting login-time JIT provisioning.

Rationale

Why This Matters:

Login-only group synchronization does not promptly remove departed users.
A token-generation warning can leave JIT enabled.

Attack Prevented: Orphaned enterprise membership and stale group grants.

Prerequisites

Enterprise; SCIM-capable IdP. Manage Enterprise Settings is needed to disable JIT.

ClickOps Implementation

Open Settings → Enterprise → Membership → Members → User and IdP group provisioning. Generate the SCIM bearer token and store it securely with the displayed base URL.
Configure the IdP using the vendor SCIM procedure, including create/update/deactivate operations and matching work-email/userName mappings.
Confirm Just-in-time (JIT) provisioning is off. Token generation only attempts to disable it; missing permissions or errors leave it on.

Code Implementation

SCIM is the enforcement interface configured in the IdP. The Terraform pack is partial inventory only, not proof that SCIM/JIT settings are correct or that all group-derived users were enumerated.

Code Pack: Terraform

hth-devin-1.02-inventory-provisioned-users.tf View source on GitHub ↗

data "devin_users" "hth_members" {}
data "devin_idp_groups" "hth_groups" {}
output "hth_provisioning_inventory" {
  value = {
    direct_members = length(data.devin_users.hth_members.users)
    idp_groups     = length(data.devin_idp_groups.hth_groups.idp_groups)
  }
}
# Compare direct members AND IdP-derived members with the IdP in the console.
# Registered group names and direct memberships do not prove SCIM is enabled,
# JIT is disabled, or that the last deprovisioning succeeded.

Validation & Testing

Provision then deactivate a disposable pilot user; confirm enterprise membership removal and inspect active-session behavior. Reconcile both direct and group-derived access against the IdP; account for its provisioning delay.

Compliance Mappings

Framework	Control	Mapping intent
NIST SP 800-53 Rev. 5	AC-2	Supports the mapped access, configuration or monitoring objective; not a certification claim

Source: SCIM setup (verified 2026-10-29).

1.3 Minimize Roles and Service Users

Profile Level: L1 (Crawl)

Framework	Control
NIST SP 800-53 Rev. 5	AC-6

Description

Separate enterprise administration from organization work and give each automation a purpose-specific service user.

Rationale

Why This Matters:

Enterprise-level permissions can span organizations.
A shared human credential obscures ownership and offboarding.

Attack Prevented: Excessive automation privileges and lateral access across organizations.

Prerequisites

Enterprise role administration requires Manage Account Membership; read-only inventory needs the permissions listed in each pack.

ClickOps Implementation

Open Enterprise Settings → Membership → Roles; create a role with only the required permissions. Review both enterprise and organization scope.
Assign roles in Membership → Members or Groups (IdP). A direct assignment is not the effective role set: direct membership and IdP-group roles are additive unions without a role hierarchy. Enterprise administrators can access every organization. Review each granting path; login-claim refresh and SCIM propagation differ.
Create automation principals under Settings → Devin API → Service users (organization) or Enterprise settings → Devin API → Service users. Prefer organization scope when enterprise access is unnecessary.

Code Implementation

The API pack reads role definitions and service-user assignments; the Terraform alternative inventories names/scopes and counts, not permission definitions. Neither changes assignments or certifies least privilege.

Code Pack: Terraform

hth-devin-1.03-inventory-roles-and-service-users.tf View source on GitHub ↗

data "devin_roles" "hth_roles" {}
data "devin_service_users" "hth_service_users" {}
output "hth_identity_inventory_counts" {
  value = {
    enterprise_roles = length([
      for role in data.devin_roles.hth_roles.roles : role.role_id
      if role.role_type == "enterprise"
    ])
    org_roles     = length([for role in data.devin_roles.hth_roles.roles : role.role_id if role.role_type == "org"])
    service_users = length(data.devin_service_users.hth_service_users.service_users)
    enterprise_service_user_assignments = sum(concat([0], [
      for su in data.devin_service_users.hth_service_users.service_users : length([
        for assignment in su.role_assignments : assignment.role_id if assignment.org_id == null
      ])
    ]))
  }
}
# Role names/IDs alone do not expose permission definitions: inspect the Roles tab.

Code Pack: API Script

hth-devin-1.03-inventory-roles-and-service-users.sh View source on GitHub ↗

hth_init 1
[[ -n "${DEVIN_INVENTORY_OUTPUT:-}" ]] || hth_unknown 'set DEVIN_INVENTORY_OUTPUT to a new evidence file'
hth_get '/v3/self' "$HTH_TEMP/self.json"
jq -e '.principal_type == "service_user" and (.service_user_id | type == "string")' \
  "$HTH_TEMP/self.json" >/dev/null || hth_unknown 'use a dedicated service user, not a personal token, for this inventory'
hth_paginate '/v3/enterprise/roles' "$HTH_TEMP/roles.jsonl"
hth_paginate '/v3/enterprise/members/service-users' "$HTH_TEMP/service-users.jsonl" 'include_inactive=true'
jq -se 'all(.[]; (.role_id | type == "string" and length > 0) and
  (.role_name | type == "string") and (.role_type == "enterprise" or .role_type == "org"))' \
  "$HTH_TEMP/roles.jsonl" >/dev/null || hth_unknown 'invalid role record'
jq -se 'all(.[]; (.service_user_id | type == "string") and (.name | type == "string") and
  has("expires_at") and has("deleted_at") and (.role_assignments | type == "array") and
  all(.role_assignments[]; (.role.role_id | type == "string")))' \
  "$HTH_TEMP/service-users.jsonl" >/dev/null || hth_unknown 'invalid service-user record'
# Role listings omit permissions; fetch each detail instead of inventing them.
(( $(jq -s 'length' "$HTH_TEMP/roles.jsonl") <= 1000 )) || hth_unknown 'more than 1000 roles; scope and review before collecting details'
: > "$HTH_TEMP/role-details.jsonl"
while IFS= read -r role_id; do
  hth_get "/v3/enterprise/roles/$(jq -rn --arg id "$role_id" '$id | @uri')" "$HTH_TEMP/role.json"
  jq -e --arg id "$role_id" '.role_id == $id and (.permissions | type == "array") and
    all(.permissions[]; type == "string")' "$HTH_TEMP/role.json" >/dev/null || hth_unknown 'role permissions missing or malformed'
  jq -c '.' "$HTH_TEMP/role.json" >> "$HTH_TEMP/role-details.jsonl"
done < <(jq -r '.role_id' "$HTH_TEMP/roles.jsonl")
jq -n --slurpfile identity "$HTH_TEMP/self.json" --slurpfile roles "$HTH_TEMP/role-details.jsonl" \
  --slurpfile service_users "$HTH_TEMP/service-users.jsonl" \
  '{identity:$identity[0],roles:$roles,service_users:$service_users}' > "$HTH_TEMP/inventory.json"
hth_save_private "$HTH_TEMP/inventory.json" "$DEVIN_INVENTORY_OUTPUT"
printf 'COLLECTED: %s roles and %s service users (including inactive); review the private inventory against approved access.\n' \
  "$(jq -s 'length' "$HTH_TEMP/roles.jsonl")" "$(jq -s 'length' "$HTH_TEMP/service-users.jsonl")"

Validation & Testing

Compare every assignment with an approved owner/purpose inventory. Test a representative denied operation with a pilot principal. Review after team changes and monthly.

Compliance Mappings

Framework	Control	Mapping intent
NIST SP 800-53 Rev. 5	AC-6	Supports the mapped access, configuration or monitoring objective; not a certification claim

Source: Custom roles · API authentication (verified 2026-10-29).

1.4 Govern Personal Access Tokens

Profile Level: L2 (Walk)

Framework	Control
NIST SP 800-53 Rev. 5	IA-5, AC-6

Description

Keep enterprise PATs disabled unless necessary; otherwise require approval and a short maximum lifetime.

Rationale

Why This Matters:

PATs inherit the human user’s rights across accessible organizations.
Non-expiring human credentials are unsuitable for shared production automation.

Attack Prevented: Long-lived credential misuse and unreviewed programmatic access.

Prerequisites

Enterprise PAT policy: Manage enterprise settings. Inventory/revocation: Manage account API keys.

ClickOps Implementation

Open enterprise Devin API → PAT policies. Retain Disabled, or choose Approval required when a documented workflow needs PATs.
Set the shortest practical maximum lifetime rather than accepting the 365-day default. Review requests in the Approval queue.
Review PAT inventory. Before tightening policy, inspect the confirmation: affected tokens are revoked; disabling revokes every active PAT and cancels pending requests.

Automation: ClickOps only for enterprise PAT policy — no policy write handle was found in the fetched public v3 OpenAPI/provider index. Service-user endpoints do not manage human PAT policy (PAT documentation, verified 2026-10-29).

Validation & Testing

Test with a pilot user that self-service creation is unavailable and expiration is capped. Coordinate revocation with tool owners to avoid breaking active workflows.

Compliance Mappings

Framework	Control	Mapping intent
NIST SP 800-53 Rev. 5	IA-5, AC-6	Supports the mapped access, configuration or monitoring objective; not a certification claim

Source: Personal access tokens (verified 2026-10-29).

2. Network & Execution Boundaries

2.1 Restrict Inbound Access with IP Access Lists

Profile Level: L2 (Walk)

Framework	Control
NIST SP 800-53 Rev. 5	AC-3, SC-7

Description

Limit enterprise webapp and API ingress to approved corporate, VPN and automation egress CIDRs.

Rationale

Why This Matters:

A stolen credential remains usable from an attacker network without an ingress boundary.
Empty lists remove restrictions; incomplete replacements can lock out administrators.

Attack Prevented: Credential replay from unapproved networks.

Prerequisites

Enterprise; the GET endpoint requires Manage IP Whitelist, even for this read-only audit. Prove an independent allowed administrator route before writing.

ClickOps Implementation

No documented web-console editor exists for this setting. Inventory the required egress networks with networking and automation owners.
Use the read-only API pack to capture current configuration. Review the complete replacement list before the Terraform change; never use documentation example addresses.

Code Implementation

API verification is GET-only. The separate Terraform mutating pack replaces the enterprise singleton: review a plan, retain the complete approved list, and never apply without verified recovery access. Destroying the provider resource clears restrictions; its lifecycle guard is not protection after removing the block.

Code Pack: Terraform

hth-devin-2.01-restrict-inbound-access.tf View source on GitHub ↗

variable "approved_cidrs" {
  type        = list(string)
  description = "Complete approved enterprise IPv4/IPv6 CIDRs, including operator and recovery egress; no defaults."
  validation {
    condition = length(var.approved_cidrs) > 0 && alltrue([
      for cidr in var.approved_cidrs : can(cidrhost(cidr, 0)) && !endswith(cidr, "/0")
    ])
    error_message = "Supply nonempty, valid CIDRs; unrestricted /0 is forbidden."
  }
}
variable "independent_access_verified" {
  type        = bool
  description = "True only after an independent administrator proves an allowed recovery route."
  default     = false
}
resource "devin_ip_access_list" "hth_approved" {
  ip_ranges = var.approved_cidrs
  lifecycle {
    prevent_destroy = true
    precondition {
      condition     = var.independent_access_verified
      error_message = "STOP: prove a separate allowed administrative recovery route before planning a replacement."
    }
  }
}

Code Pack: API Script

hth-devin-2.01-verify-ip-access-list.sh View source on GitHub ↗

hth_init 2
[[ -r "${DEVIN_EXPECTED_IP_RANGES:-}" ]] || hth_unknown 'set DEVIN_EXPECTED_IP_RANGES to a readable approved JSON array'
hth_get '/v3/enterprise/ip-access-list' "$HTH_TEMP/ip-access-list.json"
# ipaddress canonicalizes IPv4/IPv6 networks; no addresses are printed.
# Conditional execution preserves finding (1) versus unknown (2) exit codes.
if python3 - "$HTH_TEMP/ip-access-list.json" "$DEVIN_EXPECTED_IP_RANGES" <<'PY'
import ipaddress, json, sys
try:
    with open(sys.argv[1]) as source:
        actual = json.load(source)['ip_ranges']
    with open(sys.argv[2]) as source:
        expected = json.load(source)
    def networks(values):
        if not isinstance(values, list) or any(not isinstance(v, str) for v in values):
            raise ValueError('not an array of strings')
        return {ipaddress.ip_network(v, strict=False) for v in values}
    current, approved = networks(actual), networks(expected)
    if not approved or any(n.prefixlen == 0 for n in approved):
        raise ValueError('approved baseline must restrict access')
except (OSError, ValueError, KeyError, TypeError):
    print('UNKNOWN: malformed response or missing/unsafe approved CIDR baseline', file=sys.stderr)
    sys.exit(2)
if not current or any(n.prefixlen == 0 for n in current):
    print('FINDING: no effective IP restriction for at least one address family')
    sys.exit(1)
if current != approved:
    print(f'FINDING: CIDR drift ({len(current - approved)} unexpected, {len(approved - current)} missing)')
    sys.exit(1)
print(f'MATCH: {len(current)} canonical CIDRs match the approved baseline; live access denial not tested')
PY
then
  exit 0
else
  result=$?
  exit "$result"
fi

Validation & Testing

After an authorized change, confirm allowed access and a denied request from a controlled outside network (documented denial: HTTP 401). This ingress policy does not constrain agent egress.

Compliance Mappings

Framework	Control	Mapping intent
NIST SP 800-53 Rev. 5	AC-3, SC-7	Supports the mapped access, configuration or monitoring objective; not a certification claim

Source: IP access lists (verified 2026-10-29).

2.2 Enforce Mandatory Session Security Profiles

Profile Level: L2 (Walk)

Framework	Control
NIST SP 800-53 Rev. 5	AC-3, CM-6, SC-7

Description

Bind a tested mandatory security profile to the enterprise or organization default instead of relying on an optional recommendation.

Rationale

Why This Matters:

Unbound profiles do not restrict sessions.
Recommended profiles can be overridden or explicitly opted out of.

Attack Prevented: Excessive agent network, tool and repository access.

Prerequisites

Manage security profiles at the relevant scope; enterprise-wide defaults require Enterprise. Beta API access is not guaranteed.

ClickOps Implementation

Open Enterprise settings → Devin → Security profiles, or Settings → Customization → Security profiles for organization scope.
Create a pilot profile with narrow destinations, approved MCP servers, read-only Git/Devin MCP and GitHub CLI token removal where feasible. Pilot compatibility, then select Mandatory and bind the default.
Inspect automation and session selections. Restart or wake existing sessions after changes; running sessions retain the restrictions from their last boot/wake.

Code Implementation

The beta API pack inventories profiles and default bindings only; it does not prove effective policy on every session. Authentication/plan failures are unknown evidence, not a secure result. No automatic binding changes are made.

Code Pack: API Script

hth-devin-2.02-audit-security-profile-default.sh View source on GitHub ↗

hth_init 2
hth_paginate '/v3beta1/enterprise/security-profiles' "$HTH_TEMP/profiles.jsonl"
hth_get '/v3beta1/enterprise/security-profile-settings' "$HTH_TEMP/settings.json"
jq -e '.default | (.selection == "none" or .selection == "profile")' \
  "$HTH_TEMP/settings.json" >/dev/null || hth_unknown 'malformed enterprise default selection'
if [[ "$(jq -r '.default.selection' "$HTH_TEMP/settings.json")" != profile ]]; then
  echo 'FINDING: no enterprise default security profile'; exit 1
fi
profile_id="$(jq -r '.default.profile_id // empty' "$HTH_TEMP/settings.json")"
[[ -n "$profile_id" ]] || hth_unknown 'profile selection has no profile_id'
jq -s --arg id "$profile_id" '[.[] | select(.profile_id == $id)]' \
  "$HTH_TEMP/profiles.jsonl" > "$HTH_TEMP/selected.json"
[[ "$(jq 'length' "$HTH_TEMP/selected.json")" == 1 ]] || hth_unknown 'default does not resolve to exactly one visible enterprise profile'
jq '.[0]' "$HTH_TEMP/selected.json" > "$HTH_TEMP/profile.json"
jq -e '(.enforcement_level == "mandatory" or .enforcement_level == "recommended") and
  (.git_access_level == "read_only" or .git_access_level == "read_write") and
  (.devin_mcp_read_only | type == "boolean") and (.remove_github_cli_token | type == "boolean") and
  (.net_policy == null or ((.net_policy | type == "object" and keys == ["allow"]) and
    (.net_policy.allow | type == "array") and
    all(.net_policy.allow[]; type == "object" and
      ((keys == ["hostname"] and (.hostname | type == "string" and length > 0)) or
       (keys == ["ipv4"] and (.ipv4 | type == "string" and length > 0)) or
       (keys == ["ipv6"] and (.ipv6 | type == "string" and length > 0)))))) and
  (.mcp_config == null or ((.mcp_config | type == "object" and keys == ["servers"]) and
    (.mcp_config.servers | type == "array") and all(.mcp_config.servers[]; type == "string" and length > 0)))' \
  "$HTH_TEMP/profile.json" >/dev/null || hth_unknown 'malformed security profile fields'
# Validate CIDR address families as well as JSON types; unknown schema never passes.
if python3 - "$HTH_TEMP/profile.json" <<'PYCODE'
import ipaddress, json, sys
with open(sys.argv[1]) as source:
    profile = json.load(source)
try:
    unrestricted = False
    for entry in (profile.get('net_policy') or {}).get('allow', []):
        for key, version in [('ipv4', 4), ('ipv6', 6)]:
            if key in entry:
                network = ipaddress.ip_network(entry[key], strict=False)
                if network.version != version:
                    raise ValueError('address-family mismatch')
                unrestricted = unrestricted or network.prefixlen == 0
except ValueError:
    print('UNKNOWN: invalid network-policy CIDR', file=sys.stderr)
    sys.exit(2)
if unrestricted:
    print('FINDING: network policy contains an unrestricted CIDR')
    sys.exit(1)
PYCODE
then
  :
else
  result=$?
  exit "$result"
fi
# This baseline is intentionally restrictive. An approved write workflow needs a separate review.
jq '[
  if .enforcement_level != "mandatory" then "default is only recommended" else empty end,
  if .net_policy == null then "network policy has no opinion" else empty end,
  if any((.net_policy.allow // [])[]; .hostname == "*" or .ipv4 == "0.0.0.0/0" or .ipv6 == "::/0")
    then "network policy contains an unrestricted destination" else empty end,
  if .mcp_config == null then "MCP policy has no opinion" else empty end,
  if .git_access_level != "read_only" then "git writes are permitted" else empty end,
  if .devin_mcp_read_only != true then "Devin management MCP writes are permitted" else empty end,
  if .remove_github_cli_token != true then "GitHub CLI token is retained" else empty end
]' "$HTH_TEMP/profile.json" > "$HTH_TEMP/findings.json"
if [[ "$(jq 'length' "$HTH_TEMP/findings.json")" != 0 ]]; then
  jq -r '.[] | "FINDING: " + .' "$HTH_TEMP/findings.json"; exit 1
fi
echo 'CONFIGURED: mandatory read-only enterprise default with explicit network/MCP policies; review allowlists and verify a newly booted session separately'

Validation & Testing

November 2 release notes specifically say automation network-policy edits now apply to active automation sessions. Do not generalize this exception to all profile fields.

In a new pilot session, verify a required destination works and an unapproved destination does not; try an opt-out and confirm the mandatory floor remains. Keep required vendor destinations in mind.

Compliance Mappings

Framework	Control	Mapping intent
NIST SP 800-53 Rev. 5	AC-3, CM-6, SC-7	Supports the mapped access, configuration or monitoring objective; not a certification claim

Source: Security profiles (verified 2026-10-29).

2.3 Separate Build and Outpost Network Boundaries

Profile Level: L3 (Run)

Framework	Control
NIST SP 800-53 Rev. 5	SC-7, CM-6

Description

Treat snapshot builds and self-hosted Outpost workers as separate enforcement boundaries, not inherited proof of session isolation.

Rationale

Why This Matters:

A build-default override can replace even a mandatory session default.
An Outpost policy description is not a firewall.

Attack Prevented: Exfiltration through privileged build jobs or unrestricted self-hosted execution.

Prerequisites

Security-profile manager plus build/Outpost infrastructure owner; isolated pilot execution environment.

ClickOps Implementation

In enterprise security settings, inspect Default profile for snapshot builds. Select a reviewed build network policy rather than No profile; only the network restriction applies to builds.
For Outposts, require the orchestrator to enforce each queued session’s effective spec.network_policy at the infrastructure layer before starting its worker. Re-read when re-queued; do not assume cached policy remains valid.

Automation: The build-default settings API and Outposts fleet API expose policy, but actual Outpost egress enforcement is infrastructure-specific. The Outposts reference documents the contract; this guide deliberately does not supply a universal firewall or claim the worker installs one (verified 2026-10-29).

Validation & Testing

Run separate benign allowed/denied egress tests in a snapshot build and an Outpost session. Stop worker admission if your orchestrator cannot establish its required boundary.

Compliance Mappings

Framework	Control	Mapping intent
NIST SP 800-53 Rev. 5	SC-7, CM-6	Supports the mapped access, configuration or monitoring objective; not a certification claim

Source: Build/Outpost profile behavior · Outposts contract (verified 2026-10-29).

2.4 Constrain Devin Connect Routes and Gateway Identity

Profile Level: L3 (Run)

Description

For dedicated deployments, authorize each destination on both the Devin Connect control plane and the customer gateway. Keep the gateway administration listener private and route policy default-deny.

Rationale

Why This Matters:

A session security profile and a gateway route are separate intersecting boundaries.
Omitting a route port permits every port for the matching destination; a leaked enrollment token can impersonate a gateway.

Attack Prevented: Unintended access from cloud agents to private services and unauthorized gateway enrollment.

Prerequisites

Dedicated single-tenant deployment, approved destination/port inventory, network owner and enrollment-token secret storage.

ClickOps Implementation

Open Enterprise Settings → Devin Connect → Add gateway; choose Tunnel or Direct for the actual deployment. In Add destination, use approved exact hosts or supported IPv4 CIDRs; wildcards are not accepted.
Generate the enrollment token through the gateway workflow and mount it as a protected token file. Keep it out of images, logs, command arguments and repository files. Regeneration revokes the old token; coordinate replacement and availability.
Copy the deployment configuration again after destination changes. On the customer host, keep admin_listen on loopback, enumerate route ports, and apply a matching session network profile. An empty route list denies destinations.
For Tunnel, permit only the provided TLS edge and necessary proxy/CA path. For Direct/PrivateLink, use the actual AWS principal supplied by Cognition; do not expose the listener publicly or guess an account ID.

Code Implementation

The config emitter produces an inert deny-all Tunnel configuration using confirmed gateway values and a token-file path; it does not enroll or start a daemon. The first-party gateway validate-config wrapper only validates a reviewed file. Review and add exact routes through configuration management before an approved deployment. JSONL connection events exist, but their full field schema was not established, so no speculative SIEM detection is shipped.

Code Pack: Config

hth-devin-2.04-connect-deny-all.sh View source on GitHub ↗

set +x
set -Eeuo pipefail
umask 077
unknown() { printf 'UNKNOWN: %s\n' "$*" >&2; exit 2; }
case "${HTH_PROFILE_LEVEL:-1}" in 3|4) ;; *) unknown 'HTH_PROFILE_LEVEL=3..4 required before generation' ;; esac
command -v jq >/dev/null || unknown 'jq is required'
[[ "${DEVIN_CONNECT_ENDPOINT:-}" =~ ^[a-zA-Z0-9][a-zA-Z0-9.-]+:443$ ]] || unknown 'supply the confirmed host:443 Tunnel endpoint (without a scheme)'
[[ "${DEVIN_CONNECT_GATEWAY_ID:-}" =~ ^[a-zA-Z0-9_-]+$ ]] || unknown 'supply the confirmed gateway ID'
[[ "${DEVIN_CONNECT_TOKEN_FILE:-}" =~ ^/[a-zA-Z0-9_./-]+$ ]] || unknown 'supply the protected absolute token-file path, never the token'
# JSON strings are valid YAML scalars. Empty routes intentionally deny all.
printf 'schema_version: 1\nadmin_listen: "127.0.0.1:9090"\nroutes: []\ntunnel:\n'
printf '  endpoint: %s\n' "$(jq -Rn --arg v "$DEVIN_CONNECT_ENDPOINT" '$v')"
printf '  gateway_id: %s\n' "$(jq -Rn --arg v "$DEVIN_CONNECT_GATEWAY_ID" '$v')"
printf '  auth_token_file: %s\n' "$(jq -Rn --arg v "$DEVIN_CONNECT_TOKEN_FILE" '$v')"
printf 'EMITTED ONLY: no enrollment, daemon start or policy deployment; add reviewed exact routes and ports before approved use.\n' >&2

Code Pack: CLI Script

hth-devin-2.04-validate-connect.sh View source on GitHub ↗

set +x
set -Eeuo pipefail
case "${HTH_PROFILE_LEVEL:-1}" in 3|4) ;; *) printf 'UNKNOWN: HTH_PROFILE_LEVEL=3..4 required.\n' >&2; exit 2 ;; esac
[[ $# == 1 && -f "$1" && ! -L "$1" ]] || { printf 'Usage: bash %s REVIEWED_CONFIG.yml\n' "$0" >&2; exit 2; }
command -v gateway >/dev/null || { printf 'UNKNOWN: install the approved gateway binary separately.\n' >&2; exit 2; }
# validate-config is the offline validation command; doctor probes and serve starts a daemon.
exec gateway validate-config --config "$1"

Validation & Testing

Validate offline, then on an authorized pilot test an allowed host/port and a controlled denied host/port. Inspect conn_open, conn_close and denial records privately. Reload validation rejects the whole invalid file and retains the previous policy; check effective policy and last-seen status rather than assuming an edited file was accepted. Stop the gateway/disable destinations to contain access, then rotate tokens and investigate existing sessions.

Compliance Mappings

Framework	Control	Mapping intent
SOC 2	CC6.1, CC7.2	Supports access and monitoring objectives
NIST SP 800-53 Rev. 5	SC-7, IA-5, AU-12	Supports configuration and access boundaries
ISO 27001:2022	A.5.15, A.8.9	Supports access and configuration management

Sources: Devin Connect configuration and lifecycle (retrieved 2026-11-05; documentation-backed, no live validation).

2.5 Control Local Hands Pairing and Revoke Host Access

Profile Level: L2 (Walk)

Description

Treat Local Hands as a new connection from a cloud session to the developer OS account. Permit it only for an owned, private session and preserve per-tool approvals.

Rationale

Why This Matters:

Local tools can read, write, copy files and execute a shell with the local user’s authority.
A public session can be steered by others, while a saved local bypass setting can approve pending requests immediately.

Attack Prevented: Unreviewed cloud-to-workstation tool execution and continued local access after a task.

Prerequisites

Feature rollout and eligible human-owned session. Enterprise defaults off and non-enterprise defaults on; security-profile sessions, disabled native deployment and ownerless automation/service-user sessions are ineligible.

ClickOps Implementation

In Organization Settings → Devin → Local Hands, disable the feature unless the workflow needs it. Enable only after reviewing local permission and endpoint policy with the owner.
Pair only your own cloud session with the same-account CLI/Desktop. Pairing codes are single-use, expire in ten minutes, and a replacement invalidates the previous code. Do not publish a code or use --public for a sensitive host.
Keep Normal permissions and choose Allow once for bounded actions. Allow for this session and bypass have broader effects. Apply the CLI Local Hands control; organization deny/ask rules still apply.
At completion use Revoke access, stop the CLI with Ctrl+C, or close the Desktop connection; ending the cloud session also disconnects. Review any commands already running and credentials/files already exposed separately.

Automation: The documented organization gate is UI-managed; no setter was verified in the fetched API/provider catalogs. The native user preference and first-party CLI state checks are in CLI 2.3. Neither a local false preference nor a pairing code proves organization enforcement.

Validation & Testing

On an authorized pilot confirm a second user cannot steer the private session, tool requests ask as expected and revocation stops new local calls. Test with dummy files only. The client always asks about certain credential/destructive/privilege operations, but this is not a guarantee against every malicious instruction.

Compliance Mappings

Framework	Control	Mapping intent
SOC 2	CC6.1, CC7.2	Supports access and monitoring objectives
NIST SP 800-53 Rev. 5	AC-3, AC-6, CM-6	Supports configuration and access boundaries
ISO 27001:2022	A.5.15, A.8.9	Supports access and configuration management

Sources: Local Hands (retrieved 2026-11-05; documentation-backed, no live validation).

2.6 Reconcile Local-Agent Root Policy and Organization Overrides

Profile Level: L2 (Walk)

Description

Review effective local-agent policy at both enterprise root and organization scope; an organization list override is a complete replacement.

Rationale

Why This Matters:

A root deny/ask, model or MCP list can disappear from an override even though the root remains configured.

Attack Prevented: Unintentional weakening through incomplete organization override lists.

Prerequisites

The appropriate organization/enterprise settings permission; pilot and recovery access before changing policy.

ClickOps Implementation

Open Settings → Enterprise → Devin Desktop and review the root baseline.
At the organization’s Devin Desktop settings page inspect every Override. Copy required root entries into the complete replacement list; lists do not merge.
Use Reset to restore inheritance for that control. Organization overrides are gradual rollout; confirm availability and effective policy before relying on them.

Automation: The documented root/override workflow is UI-managed. The model-access API is documented in the Desktop guide, but a generic writer for every override was not established in the fetched current references. Local user files cannot substitute for managed configuration.

Validation & Testing

Compare root, override and actual client behavior for a harmless denied operation. Root changes reach only controls still inheriting them. Coordinate Desktop and CLI baselines; legacy Cascade settings have different applicability.

Compliance Mappings

Framework	Control	Mapping intent
SOC 2	CC6.1	Supports effective-access review
NIST SP 800-53 Rev. 5	AC-3, CM-6, SI-12	Supports access/configuration and data lifecycle
ISO 27001:2022	A.5.15, A.8.9	Supports access/configuration management

Source: Local Agent Controls (retrieved 2026-11-05; no live validation).

3. Repositories, Tools & Secrets

3.1 Limit Repository and MCP Access

Profile Level: L2 (Walk)

Framework	Control
NIST SP 800-53 Rev. 5	AC-3, AC-6

Description

Expose only approved repositories and tools to each organization; keep generated changes behind human review and SCM protections.

Rationale

Why This Matters:

A broad integration grant exposes unrelated code to agent tasks.
Repository access, MCP access and direct GitHub API access are different permissions.

Attack Prevented: Cross-repository access and unexpected tool-driven changes.

Prerequisites

Administrator of the relevant SCM connection and Devin repository/security-profile manager. Review each connector’s real account/token requirements; GitHub App grants do not describe GitLab or Bitbucket authority.

ClickOps Implementation

In Settings → Connections → GitHub, review the connection. In GitHub organization Settings → GitHub Apps → Devin.ai Integration → Configure → Repository access, select only approved repositories.
Delegate repositories to the appropriate Devin organizations under Settings → Repositories. Remove unnecessary broad grants; apply protected-branch review/check requirements in your SCM.
Use the profile in 2.2 for MCP restrictions and GitHub CLI token removal. A network allowlist alone does not disable an allowed MCP server.
For GitLab, use Settings → Connections → GitLab and a dedicated service identity. The documented PAT connection requires api scope; keep its upstream memberships narrow. Review both organization delegation and personal Link identities/“Open PRs as” behavior. Where automatic webhook setup is available, it can install hooks on every project/group that identity administers; review the installation inventory and secret token separately.
For Bitbucket, review Settings → Connections → Bitbucket and whether the connection is a Premium workspace token or dedicated-account OAuth. Documented token setup requires repository administration and webhook read/write; OAuth hook installation requires repository admin. Review per-repository installed/skipped webhook status rather than assuming automatic review works everywhere. Devin’s own writes use the connection identity; human Review actions use the actor’s separate linked account. Revoke obsolete connection and personal grants upstream as well as in Devin.

Code Implementation

The Terraform pack grants read-only access to one exact repository. It is additive, not an authoritative restriction: overlapping group/prefix grants must be reviewed separately. Private DeepWiki indexing is covered in its product guide.

Code Pack: Terraform

hth-devin-3.01-limit-repository-access.tf View source on GitHub ↗

variable "org_id" {
  type = string
}
variable "git_connection_id" {
  type = string
}
variable "approved_repo_path" {
  type        = string
  description = "One exact owner/repository path approved for this organization."
  validation {
    condition     = can(regex("^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$", var.approved_repo_path))
    error_message = "Provide an exact owner/repository path, never a wildcard or group prefix."
  }
}
resource "devin_git_permission" "hth_one_repo" {
  org_id            = var.org_id
  git_connection_id = var.git_connection_id
  repo_path         = var.approved_repo_path
  read_only         = true
}

Validation & Testing

Use a pilot account/session to confirm an unauthorized repository is inaccessible, and a read-only task cannot push. Require review before merges; do not automatically approve agent PRs.

Compliance Mappings

Framework	Control	Mapping intent
NIST SP 800-53 Rev. 5	AC-3, AC-6	Supports the mapped access, configuration or monitoring objective; not a certification claim

Sources: GitHub integration, GitLab identity/webhooks, Bitbucket identities/webhooks, Security profiles (retrieved 2026-11-05).

3.2 Scope Secrets and Prefer Workload Identity

Profile Level: L2 (Walk)

Framework	Control
NIST SP 800-53 Rev. 5	IA-5, AC-6

Description

Use the narrowest secret scope and replace static cloud credentials with scoped workload federation where supported.

Rationale

Why This Matters:

Organization secrets are usable by all member sessions.
Agent-readable credentials can be misused following prompt injection.

Attack Prevented: Credential exposure and reusable cloud-token theft.

Prerequisites

Secret administrator; cloud/IAM owner for OIDC. Use dedicated service accounts, never a personal account’s TOTP or browser session.

ClickOps Implementation

Review Settings → Resources → Secrets. Prefer personal/session scope for individual tasks and repository scope under Settings → Environment → Blueprints → repository → Secrets for repo-bound credentials.
For cloud access, follow the provider-specific OIDC setup action in the environment blueprint’s initialize phase. Constrain issuer, audience and organization subject in the relying party; do not trust every Devin organization.
Revoke unused upstream credentials. Avoid secrets in prompts, repository files, logs or snapshots.

Automation: Devin documents secrets APIs, the devin_secret Terraform resource and OIDC setup actions. No generic credential-writing pack is supplied: Terraform secret values enter state and cloud trust must be provider-specific. Follow the OIDC action instructions with a reviewed pinned action revision; do not copy unrestricted trust (verified 2026-10-29).

Validation & Testing

In a disposable session, confirm the expected cloud identity and denied access to an unrelated resource. Verify that a different organization cannot obtain the role. Never print the OIDC token.

Compliance Mappings

Framework	Control	Mapping intent
NIST SP 800-53 Rev. 5	IA-5, AC-6	Supports the mapped access, configuration or monitoring objective; not a certification claim

Source: Secrets · Workload identity (verified 2026-10-29).

3.3 Bound Automations, Oncall and Auto-triage Authority

Profile Level: L2 (Walk)

Description

Review the effective principal, every event trigger, tool grant, network policy and budget before enabling an automation or responder. Treat integration payloads as untrusted input to an action-capable agent.

Rationale

Why This Matters:

Triggers are ORed, so a broad additional trigger can bypass a narrow channel or issue filter.
Default organization execution may resolve to a configured service user or SystemUser; reply access is different from trigger admission.

Attack Prevented: Untrusted Slack, SCM, incident or webhook content initiating excessive agent actions.

Prerequisites

Automation/Oncall management rights; approved service-user role, integration scope and incident owner. The provider requires Terraform state access protection.

ClickOps Implementation

Open Automations → Create automation or edit an existing automation; in Oncall, inspect each responder’s triggers and runbook. Choose an explicit reviewed execution principal and minimum tool/network grants. Do not rely on an unset organization default identity.
Constrain Slack channel/user/group filters and Teams installation scope. Slack automations can read and write the trigger channel by default. Prefer reply access restricted to Devin users where appropriate; this does not restrict which events start a run.
Under Settings → Connections → GitHub → connection menu → Automation Scope, retain private-repository scope unless public comments are deliberately trusted. For webhooks use X-Webhook-Secret, rotate on exposure, and validate/replay-control events at the upstream source; no signed/replay-protected webhook guarantee was verified.
Set ACU, invocation and concurrency limits and a narrow network policy. Preflight is not an authorization boundary: Run now bypasses it, and script tests can execute real external writes. Limit selected secrets.
Review Enterprise Settings → Devin → Dynamic workflows (enterprise default off) before permitting deterministic orchestration and its child-session authority. Review reusable workflow/skill changes as code, and retain the parent session’s identity/tool/network boundaries.
For Auto-triage, review persistent shared scratchpad context, child-session budgets and Linear write access. For Oncall, review learned skills and Settings/gear → Instructions → Skills refresh policy; select Never where updates require approval. Disable triggers to stop new admission and inspect active sessions separately.

Code Implementation

The API collector inventories every page of automation and responder configuration using GET, redacts webhook URLs/runbook bodies, and fails unknown on malformed or incomplete evidence. The Terraform data source inventories Oncall schema capability flags; the disabled-by-default automation resource demonstrates explicit identity, limits and restricted replies. Inventory and a plan are not proof of a safe effective principal. Existing migrated schedules are not silently recreated as automations.

Code Pack: Terraform

hth-devin-3.03-bound-automations.tf View source on GitHub ↗

variable "org_id" { type = string }
variable "hth_profile_level" {
  type    = number
  default = 1
  validation {
    condition     = contains([1, 2, 3, 4], var.hth_profile_level)
    error_message = "hth_profile_level must be 1..4."
  }
}
variable "create_disabled_automation" {
  type    = bool
  default = false
}
variable "service_user_id" {
  type    = string
  default = ""
}
variable "approved_triggers" {
  description = "Reviewed nonempty trigger array; triggers OR together. No generic unfiltered event default."
  type        = any
  default     = []
}
variable "approved_actions" {
  description = "Reviewed actions, including required enterprise tags; no prompt-as-security-boundary assumption."
  type        = any
  default     = []
}
data "devin_oncall_schemas" "capabilities" {
  org_id = var.org_id
  lifecycle {
    precondition {
      condition     = var.hth_profile_level >= 2
      error_message = "Select hth_profile_level >= 2 before reading automation capabilities."
    }
  }
}
resource "devin_automation" "reviewed_disabled" {
  count                  = var.create_disabled_automation ? 1 : 0
  org_id                 = var.org_id
  name                   = "Reviewed disabled intake"
  enabled                = false
  run_as                 = "service_user"
  run_as_service_user_id = var.service_user_id
  slack_reply_access     = "devin_users"
  teams_reply_access     = "devin_users"
  triggers               = jsonencode(var.approved_triggers)
  actions                = jsonencode(var.approved_actions)
  limits = jsonencode({
    max_acu_limit = 5
    invocations   = { max_per_window = 1, window_seconds = 3600 }
  })
  concurrency = jsonencode({ max_concurrent_runs = 1, max_queue_depth = 0 })
  lifecycle {
    prevent_destroy = true
    precondition {
      condition     = length(trimspace(var.service_user_id)) > 0 && length(var.approved_triggers) > 0 && length(var.approved_actions) > 0
      error_message = "Creating even a disabled automation requires a reviewed principal, triggers and actions."
    }
  }
}
# No credentials/URL/secret outputs. Webhook secrets can nevertheless enter state.
# JSON groups are config-authoritative; out-of-band edits are NOT detected as drift.
# Import does not recover them; review the full first post-import plan.

Code Pack: API Script

hth-devin-3.03-inventory-automations.sh View source on GitHub ↗

source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/common.sh"
hth_init 2
[[ "${DEVIN_ORG_ID:-}" =~ ^[A-Za-z0-9_-]+$ ]] || hth_unknown 'set a confirmed DEVIN_ORG_ID'
[[ -n "${HTH_OUTPUT_FILE:-}" ]] || hth_unknown 'set HTH_OUTPUT_FILE to a new private evidence file'
hth_paginate "/v3/organizations/${DEVIN_ORG_ID}/automations" "$HTH_TEMP/automations.jsonl"
hth_paginate "/v3/organizations/${DEVIN_ORG_ID}/oncall/responders" "$HTH_TEMP/responders.jsonl"
jq -se 'all(.[]; (.automation_id|type=="string") and (.name|type=="string") and (.enabled|type=="boolean") and (.triggers|type=="array") and (.actions|type=="array"))' "$HTH_TEMP/automations.jsonl" >/dev/null || hth_unknown 'malformed automation item; partial evidence discarded'
jq -se 'all(.[]; (.id|type=="string") and (.name|type=="string") and (.enabled|type=="boolean") and (.triggers|type=="array"))' "$HTH_TEMP/responders.jsonl" >/dev/null || hth_unknown 'malformed responder item; partial evidence discarded'
# Event/condition configuration can itself contain secrets; keep all output private.
# Omit prompt/runbook text, actions, tools, URL/secret fields and arbitrary metadata.
jq -n --arg org "$DEVIN_ORG_ID" --slurpfile a "$HTH_TEMP/automations.jsonl" --slurpfile r "$HTH_TEMP/responders.jsonl" '
 {org_id:$org,scope:"visible to supplied credential; not an enterprise-completeness claim",
 automations:[$a[]|{automation_id,name,enabled,run_as,slack_reply_access,teams_reply_access,limits,concurrency,security_profile,
   triggers:[.triggers[]|{event_type,conditions}]}],
 responders:[$r[]|{id,name,enabled,run_as,source_channel_id,
   triggers:[.triggers[]|{event_type,conditions}]}]}' > "$HTH_TEMP/evidence.json"
hth_save_private "$HTH_TEMP/evidence.json" "$HTH_OUTPUT_FILE"
printf 'COLLECTED: %s automations; %s responders. Review scope, identity, triggers, tools and active runs separately.\n' \
 "$(jq '.automations|length' "$HTH_TEMP/evidence.json")" "$(jq '.responders|length' "$HTH_TEMP/evidence.json")"

Validation & Testing

Review each trigger independently using synthetic events and inspect Activity (documented 30-day history). Confirm a nonmatching event does not run and a harmless matching event uses the expected principal. Do not send production webhooks during document validation. November 2 notes say automation network-policy edits reach active sessions; other policy changes may require new sessions. Contain by disabling admission, canceling running work and revoking upstream credentials as needed.

Compliance Mappings

Framework	Control	Mapping intent
SOC 2	CC6.1, CC7.2	Supports access and monitoring objectives
NIST SP 800-53 Rev. 5	AC-6, SC-7, SI-4	Supports configuration and access boundaries
ISO 27001:2022	A.5.15, A.8.9	Supports access and configuration management

Sources: Automations, Oncall, Auto-triage, provider 0.5.0, Dynamic Workflows (retrieved 2026-11-05; documentation-backed, no live validation).

3.4 Separate Shared MCP, DANA and Messaging Identities

Profile Level: L2 (Walk)

Description

Grant MCP/database and messaging access to a narrowly scoped upstream identity. Distinguish personal OAuth from organization-shared credentials and model-generated instructions from enforceable database/tool permissions.

Rationale

Why This Matters:

An organization OAuth connection uses one shared service account for members; adding DANA does not make SQL read-only.
Teams delegated-token deletion does not remove the bot’s independent resource-specific consent.

Attack Prevented: Cross-user credential sharing, destructive database tools and continuing bot access after partial disconnection.

Prerequisites

Owners of each upstream account, MCP server, Slack workspace or Teams installation; read-only database roles for analysis-only work.

ClickOps Implementation

Open Customize → MCPs and inspect scope (personal, organization, enterprise), transport and credentials. Prefer per-user OAuth when isolation is required; organization OAuth must use a dedicated service account with minimum upstream grants. Review executable stdio commands and environment secrets.
For Mode → Data / Slack dana!, enable only the approved data sources and restrict writes at the database/MCP server. Review persistent database knowledge; prompts are not SQL authorization.
For dynamic credentials inspect Advanced → Header Script and the session-machine execution option. The Bash script runs before a connection, has a ten-second timeout and replaces headers; reject scripts that print credentials in logs. Error/timeout/malformed output fails the connection without fallback.
In Settings → Connections, review Slack’s file/history/write scopes and invited channels. For Teams distinguish bot installation RSC from separately linked user posting and any Microsoft 365 plugin. To remove access, uninstall the bot from the affected team/chat as well as disconnecting delegated users; verify upstream token/grant removal.

Automation: The fetched native workflow documents UI/OAuth and header-script configuration. Commercial API/MCP integration reads do not establish a shared-credential setter, and a current complete settings schema was unavailable; write automation remains unverified rather than declared nonexistent. No invented database connector SDK or SQL enforcement query is shipped.

Validation & Testing

With pilot accounts compare users’ effective upstream identity and denied write operations. Disconnect personal OAuth and separately remove bot installation to confirm both boundaries. Rotate shared secrets on compromise and investigate already-exported data; deleting a configuration does not recall it.

Compliance Mappings

Framework	Control	Mapping intent
SOC 2	CC6.1, CC7.2	Supports access and monitoring objectives
NIST SP 800-53 Rev. 5	AC-6, IA-5, AC-20	Supports configuration and access boundaries
ISO 27001:2022	A.5.15, A.8.9	Supports access and configuration management

Sources: MCP configuration, DANA, Slack, Teams (retrieved 2026-11-05; documentation-backed, no live validation).

3.5 Restrict Reusable Authenticated Browser Profiles

Profile Level: L2 (Walk)

Description

Use dedicated low-privilege browser accounts for reusable authentication blueprints and treat uploaded profile archives as credentials.

Rationale

Why This Matters:

Chrome profiles carry cookies and local storage capable of bypassing repeated login.
Blueprint setup can authenticate future organization sessions without another interactive approval.

Attack Prevented: Personal-session theft and unintended shared access through stored browser credentials.

Prerequisites

Manage Org Blueprints and ownership of the upstream application account. Default organization roles can carry blueprint-management rights; review assignments.

ClickOps Implementation

Follow Browser authentication with a fresh dedicated profile and minimum upstream permissions; never export the operator’s everyday browser profile.
In the blueprint workflow attach only the reviewed profile archive and initialization steps. Restrict the Manage Org Blueprints permission, archive storage and recipients.
On removal or offboarding delete/replace the blueprint material and revoke the upstream application sessions/tokens. Previously copied profiles and running sessions need separate containment.

Automation: The documented workflow uploads credential-bearing archives and edits blueprint initialization. Terraform blueprint/blueprint_file resources and CLI blueprint tooling exist, but no safe generic credential archive is supplied. Their availability is recorded in the census; creating or reading sensitive archives is deliberately excluded from the pack, not asserted unsupported.

Validation & Testing

Use a pilot application account to confirm its effective rights and absence of personal identities; then revoke upstream sessions and test rejection. Audit future-session initialization and retained archive copies without exposing cookie contents.

Compliance Mappings

Framework	Control	Mapping intent
SOC 2	CC6.1, CC7.2	Supports access and monitoring objectives
NIST SP 800-53 Rev. 5	IA-5, AC-6	Supports configuration and access boundaries
ISO 27001:2022	A.5.15, A.8.9	Supports access and configuration management

Sources: Browser authentication (retrieved 2026-11-05; documentation-backed, no live validation).

3.6 Review Managed Plugin Releases and Dependencies

Profile Level: L2 (Walk)

Description

Maintain a reviewed organization/enterprise plugin manifest and release process. Govern dependencies explicitly and keep independent permission controls when governance retrieval or hooks fail.

Rationale

Why This Matters:

Default-branch merges release code/instructions to future sessions.
A wildcard forbid is not a dependency exemption: required/optional dependency entries must be explicit, and a failed managed-manifest fetch leaves that level unenforced.

Attack Prevented: Supply-chain execution through unreviewed hooks, MCP servers and transitive plugins.

Prerequisites

Customize Plugins administration, protected repository default branch, reviewed plugin dependency inventory and Git connection.

ClickOps Implementation

Open Customize → Plugins → Add plugin → From repo at organization or enterprise scope. Confirm the repository and .devin-plugin/plugin.json source before adding it.
Use required/optional/forbidden entries with explicit dependencies. Enterprise outranks organization, repository and user. Organization plugins reach local clients through the primary organization; enterprise plugins span organizations.
Protect and review default-branch merges, repository .agents/skills/AGENTS instructions, shared playbooks/knowledge, and executable hooks/MCP definitions. Pilot cloud and local agents separately; this ecosystem does not configure legacy Cascade. Retain organization permission/sandbox/endpoint boundaries if fetches or hooks fail.
Review skill frontmatter as permission-bearing code: allowed-tools can remove prompts, permissions adds allow/deny/ask matchers, and permissions remain after invocation. Automatic model invocation is the default; use the documented user-only trigger when appropriate. Review all supported skill-discovery paths, including other agent-tool directories, rather than only .agents/skills.
Use Skills for new instructions. Legacy Knowledge is deprecated and migrates to Skills in Plugins; from October 24 new accounts have Skills without Playbooks, and migrated Playbook APIs read/write the skill. Existing provider handles do not prove the old UI/workflow still applies to every account.

Code Implementation

The native manifest fragment is inert until reviewed and merged into the correct managed manifest. Its empty reviewed exceptions plus wildcard forbid are a restrictive starting point; explicitly enumerate approved required/optional plugins and dependencies before production use. It does not deploy or fetch plugins.

Code Pack: Config

hth-devin-3.06-managed-plugins.jsonc View source on GitHub ↗

// Managed manifest fragment, NOT user config or system.json. Strip comments for strict JSON.
// Inventory business-critical plugins first; enumerate each approved dependency explicitly.
// Manifest fetch failure can leave this level unenforced. Retain independent permissions.
{
  "requiredPlugins": [],
  "optionalPlugins": [],
  "forbiddenPlugins": ["*"]
}

Validation & Testing

Test an approved plugin and an unapproved dependency on a disposable pilot. Inspect effective sources and retrieval errors at each scope. Roll back the repository release and remove access/credentials separately if plugin code already ran. Current generic hook documentation is best-effort; see the CLI guide for version-specific fail_closed documentation conflict.

Compliance Mappings

Framework	Control	Mapping intent
SOC 2	CC6.1, CC7.2	Supports access and monitoring objectives
NIST SP 800-53 Rev. 5	AC-3, AC-6, CM-6	Supports configuration and access boundaries
ISO 27001:2022	A.5.15, A.8.9	Supports access and configuration management

Sources: Managed plugin ecosystem, CLI plugin reference, Skills permissions/discovery/migration, deprecated Knowledge (retrieved 2026-11-05; documentation-backed, no live validation).

3.7 Constrain Review Approvals, Auto-Fix and Security Actions

Profile Level: L2 (Walk)

Description

Enroll repositories and users separately for auto-review, custom reviewers and Autoapprover. Govern approval-producing and code-changing features with repository authorization and explicit exclusions.

Rationale

Why This Matters:

Autoapprover beta posts a real SCM approval that can unblock an existing merge queue or auto-merge.
Removing an enrollment rule does not revoke an approval already posted; CI success can mean review completion rather than no findings.

Attack Prevented: Unexpected merge authorization and excessive code-changing actions from automated review or security findings.

Prerequisites

Review-management permission, SCM branch-policy owner and eligible feature plan/beta. Security scans/finding changes require their separate RBAC permissions.

ClickOps Implementation

Open Settings → Review, inspect each enrollment rule by repository, author, branch, label and diff limits, and add sensitive-scope exclusions. Exclusions take precedence; a personal Manual setting does not disable another matching rule.
Inspect Autoapprover enrollment independently and leave it disabled unless real approval is intended. Treat custom reviewer skills and shared enterprise instructions as executable review inputs; default-branch updates affect future reviews.
Under Settings → Devin → Pull requests → Responding to bots, prefer Selected bots over All Bots for Auto-Fix. This is an organization-wide write-capable session trigger, not a one-PR preference.
In Security, separate Start/Manage Scans and Manage Findings permissions from Fix with Devin. Review repository grants and profile availability. A Reviewed finding is not proof that its fix merged.
To contain, remove future enrollment, inspect and dismiss existing SCM approvals where required, stop active fix sessions and review commits/check requirements. Enforce intended checks and authorized reviewers in the SCM.

Automation: Review/security API families are documented, but a complete current settings schema could not be exported. Enrollment/Autoapprover writers remain unverified; scan/result APIs do not prove enrollment enforcement. No fabricated setting endpoint or automated approval/merge action is supplied.

Validation & Testing

On an authorized test repository inspect matching rules and the actual SCM check meaning. Verify that an excluded PR gets no automatic approval or fix. Inspect standing approvals after rule removal; no approval, merge or live PR test was performed in this refresh.

Compliance Mappings

Framework	Control	Mapping intent
SOC 2	CC6.1, CC7.2	Supports access and monitoring objectives
NIST SP 800-53 Rev. 5	AC-5, AC-6, CM-3	Supports configuration and access boundaries
ISO 27001:2022	A.5.15, A.8.9	Supports access and configuration management

Sources: Devin Review, Security 2.0 (retrieved 2026-11-05; documentation-backed, no live validation).

3.8 Govern Persistent Memory and Dreaming

Profile Level: L2 (Walk)

Description

Choose the allowed scope of personal memory and review persistent instructions after sensitive work.

Rationale

Why This Matters:

Turning memory off retains existing notes; automated consolidation can affect future sessions.

Attack Prevented: Unreviewed instructions persisting across sessions and mistaken assumptions about deletion.

Prerequisites

The appropriate organization/enterprise settings permission; pilot and recovery access before changing policy.

ClickOps Implementation

Review Enterprise settings → Devin → Sessions → Memory. Choose Always off where persistence is prohibited; Default on permits organization changes.
Review Settings → Devin → Sessions → Memory at organization scope and Customize → Memory personally. Memory defaults on, is personal within each organization, and automation sessions do not use it.
Inspect changes/source links and request removal through a session where needed. Disabling personal or organization memory stops use/dreaming but does not delete notes.

Automation: The fetched feature reference documents UI gates, not a verified policy API/provider writer. The open Git memory format is not an administrator enforcement API; no guessed deletion/retention endpoint is shipped.

Validation & Testing

Confirm disabled use in an authorized new session and review retained notes separately. A memory instruction is not a permission boundary.

Compliance Mappings

Framework	Control	Mapping intent
SOC 2	CC6.1	Supports effective-access review
NIST SP 800-53 Rev. 5	AC-3, CM-6, SI-12	Supports access/configuration and data lifecycle
ISO 27001:2022	A.5.15, A.8.9	Supports access/configuration management

Source: Memory and Dreaming (retrieved 2026-11-05; no live validation).

3.9 Control Native Public App Deployments

Profile Level: L2 (Walk)

Description

Disable native public deployment where unnecessary and review each approved publication as an external-data release.

Rationale

Why This Matters:

Hosted apps remain publicly reachable after the creating session ends.

Attack Prevented: Unintended publication of internal content and confusion between native and customer CI deployment authority.

Prerequisites

The appropriate organization/enterprise settings permission; pilot and recovery access before changing policy.

ClickOps Implementation

In eligible non-enterprise organizations open Settings → Devin → Enable native deployments; turn it off unless approved.
Review each explicit approve/deny deployment prompt before publication. Enterprise organizations and sessions with enforced security profiles/network policy cannot use these native deploy tools.
Govern customer CI/cloud credentials separately: those deployments use supplied tooling and are not disabled merely by the native toggle.

Automation: The fetched deployment guide documents the native UI gate and per-deploy approval. A native-toggle writer was not verified in the fetched API/provider references; no endpoint or automatic publish/delete action is invented.

Validation & Testing

On an authorized pilot confirm the tool is unavailable under the intended restriction. Stopping a session is not evidence an already-hosted site was removed; inspect published artifacts and revoke exposed credentials through the owning service.

Compliance Mappings

Framework	Control	Mapping intent
SOC 2	CC6.1	Supports effective-access review
NIST SP 800-53 Rev. 5	AC-3, CM-6, SI-12	Supports access/configuration and data lifecycle
ISO 27001:2022	A.5.15, A.8.9	Supports access/configuration management

Source: Native app deployments (retrieved 2026-11-05; no live validation).

4. Monitoring & Detection

4.1 Collect Enterprise Audit Logs

Profile Level: L1 (Crawl)

Framework	Control
NIST SP 800-53 Rev. 5	AU-2, AU-6, AU-9

Description

Collect bounded, paginated audit evidence using a dedicated service user and protect the exported records.

Rationale

Why This Matters:

A successful first page is not a complete audit interval.
Audit payloads can themselves contain sensitive content.

Attack Prevented: Undetected administrative misuse and loss of forensic visibility.

Prerequisites

Enterprise; View Audit Logs (ViewAccountAuditLogs). Protected output directory and a defined collection interval.

ClickOps Implementation

In Enterprise Settings → Membership → Roles, create a collection role with View Audit Logs and assign it to the dedicated enterprise service user.
Use the documented API collector below. The cited API reference does not establish a console export path; no fictional export button is assumed.

Code Implementation

The pack requires UTC Unix-second start/end bounds, follows cursors and fails on incomplete/malformed responses. Its conservative 31-day cap is a pack policy; the documented endpoint permits up to 100 days. Successful collection is not a clean-security verdict.

Code Pack: API Script

hth-devin-4.01-collect-audit-logs.sh View source on GitHub ↗

hth_init 1
[[ -n "${DEVIN_AUDIT_OUTPUT:-}" ]] || hth_unknown 'set DEVIN_AUDIT_OUTPUT to a new private evidence file'
[[ "${DEVIN_AUDIT_AFTER:-}" =~ ^[0-9]{1,11}$ && "${DEVIN_AUDIT_BEFORE:-}" =~ ^[0-9]{1,11}$ ]] || \
  hth_unknown 'set DEVIN_AUDIT_AFTER and DEVIN_AUDIT_BEFORE to Unix seconds'
after=$((10#$DEVIN_AUDIT_AFTER)); before=$((10#$DEVIN_AUDIT_BEFORE))
(( before > after && before - after <= 2678400 )) || hth_unknown 'request a positive time window of at most 31 days'
query="order=asc&time_after=${after}&time_before=${before}"
if [[ -n "${DEVIN_AUDIT_ACTION:-}" ]]; then
  [[ "$DEVIN_AUDIT_ACTION" =~ ^[a-z][a-z0-9_]*$ ]] || hth_unknown 'invalid audit action name'
  query+="&action=${DEVIN_AUDIT_ACTION}"
fi
hth_paginate '/v3/enterprise/audit-logs' "$HTH_TEMP/events.jsonl" "$query"
jq -se --argjson after "$after" --argjson before "$before" --arg action "${DEVIN_AUDIT_ACTION:-}" '
  all(.[]; (.audit_log_id | type == "string" and length > 0) and
    (.action | type == "string") and ($action == "" or .action == $action) and
    (.created_at | type == "number" and . == floor) and
    .created_at >= $after and .created_at <= $before and (.data | type == "object"))' \
  "$HTH_TEMP/events.jsonl" >/dev/null || hth_unknown 'malformed audit event or response outside requested filter'
jq -sc 'unique_by(.audit_log_id) | sort_by(.created_at, .audit_log_id)[]' \
  "$HTH_TEMP/events.jsonl" > "$HTH_TEMP/export.jsonl"
hth_save_private "$HTH_TEMP/export.jsonl" "$DEVIN_AUDIT_OUTPUT"
printf 'COLLECTED: %s unique audit events in the requested window; verify expected activity and ingest the private JSONL into your SIEM.\n' \
  "$(wc -l < "$HTH_TEMP/export.jsonl" | tr -d ' ')"

Validation & Testing

Generate a benign authorized pilot event and confirm it appears in the protected collection. Test pagination and collector-failure alerting. Ship to your SIEM with a separately reviewed schema/retention policy.

Compliance Mappings

Framework	Control	Mapping intent
NIST SP 800-53 Rev. 5	AU-2, AU-6, AU-9	Supports the mapped access, configuration or monitoring objective; not a certification claim

Source: Audit API (verified 2026-10-29).

4.2 Configure Input Guardrails

Profile Level: L2 (Walk)

Framework	Control
NIST SP 800-53 Rev. 5	SI-4, AU-6

Description

Enable enterprise input guardrails as defense in depth, with monitored responses and a tested blocking policy.

Rationale

Why This Matters:

Warnings and log-only modes still process the message.
Message screening cannot substitute for tool, network or credential boundaries.

Attack Prevented: Known malicious-message patterns reaching agent processing; not all prompt injection.

Prerequisites

Enterprise feature enablement may require the account team; Manage enterprise settings.

ClickOps Implementation

Open enterprise Settings → Guardrails → Guardrails and inspect each preset’s description/examples.
Use Log only during a controlled pilot; then select Block message for reviewed categories. Warn user does not block.
Inspect Violations and route ai_guardrail_violation audit events to review. Do not configure historical kill_session: it is no longer a selectable action.

Code Implementation

Configuration is ClickOps; the documented API supports violation reads, not a guardrail-policy writer. Reuse the audit pack with DEVIN_AUDIT_ACTION=ai_guardrail_violation and its required time/output variables. It collects evidence without changing policy.

Code Pack: API Script

hth-devin-4.01-collect-audit-logs.sh View source on GitHub ↗

hth_init 1
[[ -n "${DEVIN_AUDIT_OUTPUT:-}" ]] || hth_unknown 'set DEVIN_AUDIT_OUTPUT to a new private evidence file'
[[ "${DEVIN_AUDIT_AFTER:-}" =~ ^[0-9]{1,11}$ && "${DEVIN_AUDIT_BEFORE:-}" =~ ^[0-9]{1,11}$ ]] || \
  hth_unknown 'set DEVIN_AUDIT_AFTER and DEVIN_AUDIT_BEFORE to Unix seconds'
after=$((10#$DEVIN_AUDIT_AFTER)); before=$((10#$DEVIN_AUDIT_BEFORE))
(( before > after && before - after <= 2678400 )) || hth_unknown 'request a positive time window of at most 31 days'
query="order=asc&time_after=${after}&time_before=${before}"
if [[ -n "${DEVIN_AUDIT_ACTION:-}" ]]; then
  [[ "$DEVIN_AUDIT_ACTION" =~ ^[a-z][a-z0-9_]*$ ]] || hth_unknown 'invalid audit action name'
  query+="&action=${DEVIN_AUDIT_ACTION}"
fi
hth_paginate '/v3/enterprise/audit-logs' "$HTH_TEMP/events.jsonl" "$query"
jq -se --argjson after "$after" --argjson before "$before" --arg action "${DEVIN_AUDIT_ACTION:-}" '
  all(.[]; (.audit_log_id | type == "string" and length > 0) and
    (.action | type == "string") and ($action == "" or .action == $action) and
    (.created_at | type == "number" and . == floor) and
    .created_at >= $after and .created_at <= $before and (.data | type == "object"))' \
  "$HTH_TEMP/events.jsonl" >/dev/null || hth_unknown 'malformed audit event or response outside requested filter'
jq -sc 'unique_by(.audit_log_id) | sort_by(.created_at, .audit_log_id)[]' \
  "$HTH_TEMP/events.jsonl" > "$HTH_TEMP/export.jsonl"
hth_save_private "$HTH_TEMP/export.jsonl" "$DEVIN_AUDIT_OUTPUT"
printf 'COLLECTED: %s unique audit events in the requested window; verify expected activity and ingest the private JSONL into your SIEM.\n' \
  "$(wc -l < "$HTH_TEMP/export.jsonl" | tr -d ' ')"

Validation & Testing

Test a harmless vendor-provided example and a normal work request. Confirm the selected action and recorded event. Screening covers incoming initial/follow-up messages and PR comments, not an asserted universal content firewall.

Compliance Mappings

Framework	Control	Mapping intent
NIST SP 800-53 Rev. 5	SI-4, AU-6	Supports the mapped access, configuration or monitoring objective; not a certification claim

Source: AI Guardrails (verified 2026-10-29).

4.3 Plan Customer-Managed Encryption Key Lifecycle

Profile Level: L3 (Run)

Description

For eligible dedicated deployments, select and govern the customer-managed KMS key before provisioning and preserve the ability to decrypt required data.

Rationale

Why This Matters:

The configured KMS ARN is fixed when the tenant is created and cannot later be replaced through this feature.
Disabling the key or revoking required Cognition access can interrupt the service.

Attack Prevented: Unreviewed key access and accidental loss of application availability.

Prerequisites

Enterprise Assured dedicated deployment, AWS KMS administrator and Cognition account team. Key rotation of material differs from changing the configured ARN.

ClickOps Implementation

Before tenant creation, agree the supported symmetric encryption key and exact Cognition AWS principal(s) with the account team. Apply only that reviewed key policy; do not substitute documentation example accounts.
Record key ownership, CloudTrail monitoring, rotation and recovery procedures. Protect administrative policy edits and test the recovery process with the service owner.
Coordinate disablement, revocation and deletion as availability-affecting changes. Use customer KMS monitoring to detect policy/use anomalies; do not claim a Devin UI switch exists.

Automation: Cognition-assisted provisioning plus native AWS KMS key policy. No commercial Devin CMK writer or data source was established in the fetched provider/API references. A universal policy would require unknown tenant principals, so none is fabricated; customer-specific KMS configuration and evidence belong in the approved infrastructure workflow.

Validation & Testing

Confirm the configured ARN and permitted principals with the account team and review actual KMS audit evidence. Do not disable a production key for a document test. Review key policy and recovery ownership after changes.

Compliance Mappings

Framework	Control	Mapping intent
SOC 2	CC6.1, CC7.2	Supports access and monitoring objectives
NIST SP 800-53 Rev. 5	SC-12, SC-13	Supports configuration and access boundaries
ISO 27001:2022	A.5.15, A.8.9	Supports access and configuration management

Sources: Customer-managed keys (retrieved 2026-11-05; documentation-backed, no live validation).

4.4 Enable Attribution Filtering Where Required

Profile Level: L2 (Walk)

Description

For Enterprise code-use policy, ask Cognition to enable attribution filtering and verify its behavior for cloud and local agents independently.

Rationale

Why This Matters:

The feature is off by default and has no self-service enablement toggle in the documented workflow.
Cloud filtering can block or scrub generated file edits; local behavior includes reverting matching edits and flagging chat, with documented exclusions.

Attack Prevented: Some unattributed generated-code matches reaching the repository; not malware, all IP risk or prompt injection.

Prerequisites

Enterprise, account-team/support enablement and a policy owner who understands matching limits.

ClickOps Implementation

Contact the Cognition account team/support to enable attribution filtering for the intended organization/enterprise and confirm local-client applicability.
Use the documented controlled examples to compare cloud file writes and local edits/chat. Account for trivial-snippet exclusions.
Monitor filter failures: the cloud write fails closed when the attribution service or scrubbing fails. Investigate rather than disabling the feature to complete a write.

Automation: Cognition-assisted enablement; no self-service policy writer or local substitute was verified in the fetched references. Model policies and content ignore files do not enable this service. Retain the support confirmation and pilot evidence without proprietary source.

Validation & Testing

Record actual enabled scope and pilot outcome. A blocked matching sample does not prove all code is original or licensed appropriately. Keep ordinary code review and provenance processes.

Compliance Mappings

Framework	Control	Mapping intent
SOC 2	CC6.1, CC7.2	Supports access and monitoring objectives
NIST SP 800-53 Rev. 5	SI-7, CM-6	Supports configuration and access boundaries
ISO 27001:2022	A.5.15, A.8.9	Supports access and configuration management

Sources: Attribution filtering (retrieved 2026-11-05; documentation-backed, no live validation).

4.5 Set Data Controls and Verify Retention Scope

Profile Level: L1 (Crawl)

Description

Review the commercial account’s Data Controls and opt out of model training where organizational policy requires it. Verify the applicable plan and contract before sending sensitive context.

Rationale

Why This Matters:

The current security reference permits training by default for nonenterprise accounts; a paid-plan opt-out is an explicit choice, and Teams requires an administrator.
Provider Zero Data Retention does not erase product history, feedback, backups or third-party integration records.

Attack Prevented: Unintended secondary use and retention of sensitive code or conversation content beyond the approved workflow.

Prerequisites

The commercial account’s applicable plan, an authorized Teams administrator where required, and an approved data-handling policy. Enterprise commitments depend on the actual agreement; Poke and Federal have separate boundaries.

ClickOps Implementation

Open the documented Data Controls settings page for the intended commercial account and review the training preference. On an eligible paid plan, exercise the opt-out when required; on Teams, have an administrator perform it.
For Enterprise, retain the applicable agreement and confirm the documented requirement for express prior written consent before training. Do not infer an identical toggle or entitlement for every plan or acquired product.
Record provider-retention scope and exceptions separately from product history, Memory, feedback and integration storage. The published terms retain safety, abuse-review and legal-process exceptions; have the contract owner resolve any deployment-specific requirements.

Code Implementation

Automation: Unverified. The fetched security page documents Data Controls, but no training/retention policy setter or readback was established in the fetched provider/API references. Editor telemetry settings, file exclusions and memory switches do not exercise this opt-out. No guessed API or policy key is supplied.

Validation & Testing

An authorized administrator should re-open the intended account’s page and retain redacted evidence of the selected preference and its account/plan scope. Confirm contractual and provider commitments with the account owner without sending real sensitive content as a test. No tenant preference or contract was inspected in this run.

Compliance Mappings

Framework	Control	Mapping intent
NIST SP 800-53 Rev. 5	AC-21, SI-12	Supports approved information sharing and retention
ISO 27001:2022	A.5.12, A.5.23, A.8.10	Supports classification and cloud data handling

Sources: Security and Data Controls, Platform terms §§1.8, 3.3 (retrieved 2026-11-05; configuration guidance, not a contract interpretation).

5. Compliance Quick Reference

These are implementation mappings, not a Cognition benchmark or proof of compliance. No Devin/DeepWiki-specific CIS or SCuBA baseline was identified. The generic CIS AI MCP Server benchmark may inform MCP deployments; the DISA index was fetcher-limited, so STIG coverage could not be conclusively ruled out. Framework mapping does not override product plan/role prerequisites.

NIST SP 800-53 Rev. 5	Guide controls	Objective
AC-2	1.2	Account lifecycle
AC-3, AC-6	1.1, 1.3, 1.4, 2.1, 2.2, 3.1, 3.2	Access enforcement and least privilege
IA-2, IA-5	1.1, 1.4, 3.2	Identification and authenticator management
CM-6, SC-7	2.1–2.3	Configuration and boundary protection
AU-2, AU-6, AU-9, SI-4	4.1, 4.2	Event review, protection and monitoring

Appendix A: Edition and Deployment Compatibility

Surface	Availability and limits
Enterprise identity/admin	SSO/SCIM, custom enterprise roles, PAT policy, ingress list and enterprise audit API require Enterprise
Organization service users/repository integration	Use an eligible organization and the documented permissions; do not give an enterprise token to a single-org workload
Security profiles	Organization profiles and enterprise-wide profiles have different scopes; the API is beta and requires the matching Manage security profiles permission, including reads
Guardrails	Enterprise; account-team enablement may be required
Builds / Outposts	Build profiles constrain network only; Outpost network enforcement is operator-owned
Desktop / CLI / DeepWiki	Consult each product guide; a shared owner does not make cloud controls universal

Appendix B: References and Automation Coverage

Cognition source census and limitations
Devin API overview and OpenAPI schema
Official Cognition Terraform provider — pinned 0.5.0 packs; resources and data sources both inspected
NIST SP 800-53 Rev. 5

The pack separates verification from enforcement. Hub API collectors are GET-only; Terraform data sources do not enforce settings. Terraform resource examples are opt-in source artifacts, not executed changes. SSO, PAT policy, guardrails, Data Controls and secrets/trust setup require the documented administrative workflow. No GraphQL, generic SQL or invented SDK is assumed. The official CLI has cloud blueprint/secret commands; no SSO/PAT-policy/IP-list management command was established in the fetched reference. The Connect gateway has a distinct validated native configuration path. The November census records each surface’s read/write decision and uncertainty; local CLI and Outposts do not configure enterprise identity administration.

Changelog

Date	Version	Maturity	Changes	Author
2026-11-05	0.2.0	ai-drafted	Source-first scope reconciliation; self-service SSO and additive roles corrected; Connect, Local Hands, automation/integration identities, plugin/skill permissions and migration, review, memory/dreaming, native deployment, root/override, Data Controls, CMK and attribution added; Poke/Federal boundaries. Offline checks only.	Codex (GPT-6)
2026-10-30	0.1.0	ai-drafted	Initial Cognition hub and Devin Cloud controls with source-backed read-only audits and opt-in Terraform examples; no live tenant validation	Codex

Contributing

Report inaccuracies or propose improvements through GitHub issues. See the contribution guide. Re-stamp the guide and changelog dates on the actual publication date.

Devin & Cognition Hardening Guide

Overview

Intended Audience

How to Use This Guide

Scope

Products in This Platform

Table of Contents

1. Identity & Credentials

1.1 Require Enterprise SSO Without Default-Login Bypass

Description

Rationale

Prerequisites

ClickOps Implementation

Validation & Testing

Compliance Mappings

1.2 Automate Deprovisioning with SCIM

Description

Rationale

Prerequisites

ClickOps Implementation

Code Implementation

Validation & Testing

Compliance Mappings

1.3 Minimize Roles and Service Users

Description

Rationale

Prerequisites

ClickOps Implementation

Code Implementation

Validation & Testing

Compliance Mappings

1.4 Govern Personal Access Tokens

Description

Rationale

Prerequisites

ClickOps Implementation

Validation & Testing

Compliance Mappings

2. Network & Execution Boundaries

2.1 Restrict Inbound Access with IP Access Lists

Description

Rationale

Prerequisites

ClickOps Implementation

Code Implementation

Validation & Testing

Compliance Mappings

2.2 Enforce Mandatory Session Security Profiles

Description

Rationale

Prerequisites

ClickOps Implementation

Code Implementation

Validation & Testing

Compliance Mappings

2.3 Separate Build and Outpost Network Boundaries

Description

Rationale

Prerequisites

ClickOps Implementation

Validation & Testing

Compliance Mappings

2.4 Constrain Devin Connect Routes and Gateway Identity

Description

Rationale

Prerequisites

ClickOps Implementation

Code Implementation

Validation & Testing

Compliance Mappings

2.5 Control Local Hands Pairing and Revoke Host Access

Description

Rationale

Prerequisites

ClickOps Implementation

Validation & Testing

Compliance Mappings

2.6 Reconcile Local-Agent Root Policy and Organization Overrides

Description

Rationale