Security sees fragments
Provider logs show model calls. MCP servers show actions. Neither alone explains the full session or what data crossed the boundary.
Use case · Agentic software delivery
Operate GitHub Copilot as a company AI use case.
Keep the real GitHub Copilot CLI while routing its model traffic and approved MCP actions through one shared Talon boundary. Platform, security, engineering leadership and FinOps gain one identity, one effective policy, session-level spend, visible data handling and a verifiable record of what happened.
use case coding-assistant
client GitHub Copilot CLI
model gpt-4o-mini via Talon
release_status allowed + executed
release_prepare allowed + executed
release_publish did not reach upstream
PII email, person detected
handling input redaction recorded
session cost $0.001610
signed records 5 valid / 0 invalid
RESULT VERIFIEDExisting client retainedUse-case identityBounded MCP actionsData handlingSession costSigned evidence
The operational problem
A coding assistant becomes a platform concern when it can call company tools.
Autocomplete can remain an individual productivity choice. An assistant connected to repositories, release systems, tickets, infrastructure or internal knowledge becomes a company AI use case. Each team should not have to invent separate provider credentials, data rules, tool permissions, cost attribution and incident history.
Platform rebuilds controls
Every coding tool receives its own provider wiring, secrets, policy logic, cost collection and operational runbook.
Leadership cannot explain outcomes
An account-level AI bill does not show which coding use case acted, what it achieved, or why a particular action did or did not happen.
One use-case identity
Connect model traffic and MCP actions into one lifecycle.
The tested integration assigns the real Copilot CLI to the Talon operational identity coding-assistant. Three gateway calls and two MCP calls share one session, so operators can reconstruct the model-and-action timeline rather than reconcile unrelated logs.
Copilot presents a Talon use-case key. Talon resolves the effective policy and injects the vaulted provider credential upstream. Developers do not need the real OpenAI key.
GitHub Copilot CLI→ Talon session shim→ Talon model gateway + MCP proxy→ OpenAI + approved internal tools→ one signed session history
Business value by stakeholder
Keep developer velocity while making the use case operable.
CTO and engineering leadership
Move from “developers use Copilot” to an explicitly owned use case with known models, approved action paths, session outcomes and measurable spend.
Platform engineering
Offer one reusable company pattern for provider credentials, gateway policy, MCP interception, cost attribution and evidence instead of rebuilding it per tool.
Security
Allow model and tool traffic only through declared boundaries, inspect personal-data handling, and distinguish what Talon controls from local shell, file and browser activity that remains outside the boundary.
FinOps and budget owners
Attribute tokens and spend to coding-assistant, its provider, model and session—not merely to the company-wide OpenAI invoice.
Developers
Keep the real GitHub Copilot CLI and approved release tools. Governance stays underneath the workflow rather than forcing a replacement interface.
Customer assurance and incident response
Export one session-scoped, signed record showing model traffic, intercepted actions, data handling, cost and verification status.
What the verified run showed
A useful action path with a clear release boundary.
The real Copilot CLI checked release status and prepared a synthetic release. Those two operations reached the synthetic upstream through Talon's MCP proxy. No release_publish receipt existed for the fresh run nonce.
The precise claim is that publish did not reach upstream. A separate adversarial live check proves Talon denies an attempted forbidden publish call at runtime.
- Allowed
release_status - Allowed
release_prepare - Upstream boundary
release_publishabsent - Decision evidence2 signed MCP records
- Model evidence3 signed gateway records
Honest boundary
Talon governs what crosses Talon.
The case proves model traffic and MCP calls routed through Talon. It does not claim control over local shell commands, file edits, browser actions or direct APIs that bypass the gateway and MCP proxy. Client/session metadata is attribution, not independent process attestation. Signed evidence is verifiable and tamper-evident, not immutable.
Controlled
OpenAI-compatible model traffic authenticated as coding-assistant.
Controlled
MCP discovery and tool calls routed through Talon's MCP proxy.
Outside this proof
Local execution and any direct path that never enters a Talon interception point.
Pilot one engineering workflow
Start with one coding assistant and one real MCP integration.
Route the model path and a small approved tool surface through Talon. Confirm developers retain the client, security can inspect the boundary, spend is attributed to the use case, and every controlled action is verifiable. Expand only after that operating model earns trust.