GitHub Copilot, Claude Code or Codex? How I'd choose for a company

I get this question in almost every first call, usually phrased as 'which one writes the best code?'. That's the wrong question. All three write good code, open pull requests and can work on their own for hours. What actually differs is where they live, how far they go without a human, how your security team can control them and how they are billed. Get those four wrong and you end up with three tools, no central policy and an invoice nobody can explain. This is the comparison I walk clients through, based on the vendors' own documentation and changelogs as of November 2026, plus the rules I set for all three before anyone starts.

Dominik Heinrich

November 7, 202611 min read

{
  "permissions": {
    "deny": ["Read(./.env)", "Read(./secrets/**)", "Bash(kubectl delete *)"],
    "disableBypassPermissionsMode": "disable"
  },
  "allowManagedPermissionRulesOnly": true,
  "allowManagedHooksOnly": true,
  "availableModels": ["opus", "sonnet", "haiku"]
}

6. Rules that apply to all three

Whatever you pick, the same five rules carry most of the risk reduction. One instruction file per repository, AGENTS.md, CLAUDE.md or .github/copilot-instructions.md, owned by the platform team through CODEOWNERS, because these files change what an agent does. Agents work on branches only, with branch protection or rulesets and required status checks, so an agent can't merge what CI hasn't passed. A person merges, and the person who asked the agent for the change isn't the only approver. No production credentials on any machine or environment where an agent runs; agents get scoped, short-lived tokens for exactly the systems they need. And every agent action is logged where your security team already looks: Copilot's audit log and session streaming, Claude Code's Enterprise audit logs, the ChatGPT Compliance API and audit events for Codex. If you can't answer 'which agent changed this line, for whom, and who approved it', you aren't ready to scale.

textCopy

# .github/CODEOWNERS
# Instruction and agent config files change what agents do: platform team owns them.
AGENTS.md                        @your-org/platform
CLAUDE.md                        @your-org/platform
.github/copilot-instructions.md  @your-org/platform
.claude/                         @your-org/platform
.codex/                          @your-org/platform
.github/workflows/               @your-org/platform

Tip from practice

Make 'Require review from Code Owners' part of the branch rule, otherwise CODEOWNERS only suggests reviewers and an agent's change to its own instruction file can slip through.

Open full size

Close

Takeaway

The tool matters less than the rules around it: pick by where your team works, lock it down centrally, then let the pilot data decide.