AI Code Ownership Models: Who Controls What You Ship

Meta’s Muse Spark 1.2 contributor tier offers output tokens at $0.20 per million — a 21x discount from the standard $4.25 — in exchange for permission to train on your prompts and completions, the first explicitly published per-token exchange rate for training rights on developer data. That number isn’t a pricing footnote. It’s a wholesale bid for your codebase, disguised as a discount. AI code ownership models have outpaced the control planes meant to govern them, and the gap between what tools generate and what organizations can prove about origin, accountability, and data rights is widening every sprint.

Here’s the pattern I keep seeing: agentic coding output volume and session context have outpaced review queues, provenance attestation, and data-rights clarity. Code ships faster than anyone can trace where it came from or who’s accountable for it. The tools that win long-term will be the ones that integrate transparently into existing workflows — not the ones demanding you rewrite your governance model to accommodate their throughput.

What Do the Major AI Coding Tools Say About Code Ownership?

On the contractual surface, the answer is reassuringly simple: you own your code. GitHub Copilot’s terms state that GitHub does not own the suggestions Copilot generates and the user retains ownership of their code, per a SaaS law firm analysis. Cursor’s terms assign ownership of AI-generated suggestions to the user — you own both inputs and outputs. Anthropic’s Commercial Terms assign output ownership to the customer for Claude Code, meaning generated code is yours as between you and Anthropic.

That’s the vendor-level answer, and it’s consistent across the board. But the legal question of who owns AI-generated code actually comprises two parts: contractual ownership between you and the vendor, and the foundational, unresolved question of whether enforceable copyright rights exist in the code at all. The tools answer the first question cleanly. The second is where the real risk lives — and no terms-of-service clause can resolve it.

Tool	Output Ownership	Training on Your Code (Default)	IP Indemnity
GitHub Copilot	User retains ownership	Governed by plan; Business/Enterprise offer stronger protections	Yes — defends third-party claims per Layer3 Labs
Cursor (Anysphere)	User owns inputs and outputs	Privacy Mode off: may train; on (default for Teams/Enterprise): no training, ZDR	—
Claude Code (Anthropic)	Customer owns outputs	Anthropic does not train on customer content from paid services	—

GitHub Copilot’s Business and Enterprise plans provide IP indemnity defending third-party claims, a standout business feature for ownership protection, according to Layer3 Labs. That indemnity is the one structural advantage that separates Copilot’s enterprise tier from the pack — it’s not just a promise that you own the code, but a contractual defense if someone claims you don’t.

Is the Meta Contributor Tier a Discount or a Data Extraction Mechanism?

Meta frames the contributor tier as an accessibility measure — it lowers the barrier to entry for prototyping, as Ground Truth reports. The standard tier costs $1.25 per million input tokens and $4.25 per million output, with no training on your traffic. The contributor tier drops to $0.10 in and $0.20 out — a 12.5x and 21x discount — in exchange for permission to use your prompts and completions to train future Meta models, per SourceFeed.

Here’s why that should stop you before you swap API keys. In a chat product, “prompts” means what you typed. In an agentic coding tool, the prompt is assembled by the agent — and it’s stuffed with your source. Every file the agent reads into context, every diff it inspects, every test output and stack trace it feeds back to the model flows through as prompt tokens. Granting training rights on “prompts and completions” for an agent session effectively grants training rights on the entire codebase the agent touches, as SourceFeed documents. The comforting narrowness of that phrase is a chat-era intuition applied to a tool that reads your whole worktree.

It gets worse. Muse Code automatically loads machine-wide personal rules created for Codex and Claude Code — your AGENTS.md and CLAUDE.md files — into requests to Meta by default, with unclear treatment under Contributor-tier data terms, per RuntimeWire. RuntimeWire captured the first provider request and confirmed that complete contents of a personal Codex AGENTS.md file were included, even though the file was stored outside the selected Muse workspace. You can exclude foreign personal context with --no-foreign-personal-context, but the default sends it.

The cheapest AI coding tier is effectively a wholesale purchase of proprietary codebases. Engineering leaders must treat any agentic coding tool that loads entire worktrees as a potential data exporter. The Meta contributor tier should be classified as equivalent to publishing touched code, and enterprise zero-retention plans are the only safe default for proprietary work.

How Does Provenance Fit Into the Ownership Picture?

Provenance — the auditable record of who generated code, what tool was used, and what human review occurred — is the missing control plane layer. Without it, AI-generated code becomes an opaque artifact with unknown lineage, creating risks across incident response, regulatory compliance, and intellectual property management.

Several open-source projects are tackling this gap. The Pedigree project implements cryptographic provenance for AI-written code using in-toto attestations signed with ed25519, creating a tamper-evident audit trail. The Korext ai-attestation standard provides a machine-readable YAML file that tracks which AI coding tools were used, how much code they generated, and whether that code has been governance-scanned — detecting 19 AI coding tools through publicly observable signals like co-author trailers and commit message patterns.

The AEEF Standards body defines code provenance standards requiring every commit containing AI-generated code to include attribution metadata: tool, model version, prompt reference, session ID, generation date, degree of human modification, and reviewer identity. This isn’t documentation — it’s a control mechanism for governance, legal defense, and engineering improvement.

For teams building a compliance framework, provenance trailers and spending caps are the two deterministic controls that actually enforce ownership policy. If you can’t prove which model generated a commit, you can’t enforce data-rights terms retroactively. If you can’t cap agent costs, you can’t prevent unbounded data export through token volume. Our AI coding compliance guide outlines a framework with provenance trailers, spending caps, and EU AI Act readiness — the controls that matter when ownership questions move from theoretical to litigated.

What Happens When Autonomous Agents Outpace Human Review?

Anthropic is making auto mode the default in Claude Code for Pro, Max, and Team plans starting August 14, per Anthropic’s announcement. In a controlled study with 1,053 paid testers, auto mode caught 89% of harmful actions versus 13.6% for manual review — largely because users approve 97% of permission prompts, making “manual review” a rubber stamp, as TechCrunch reports. Among Teams and Enterprise adopters, auto mode users ship about 25% more PRs.

This creates a tension that’s worth sitting with. Traditional SDLC and Oracle’s OpenJDK ban assume human accountability is the safety net. Augment Code notes that a review rota sized for six human PRs a day is often the only control still standing when agents open 40 overnight, as their secure SDLC guide documents. Rootly built an internal AI code reviewer to aid human review, shifting from measuring PR size to assessing blast radius, per InfoQ. Yet Anthropic’s data suggests autonomous agents with classifier safety nets are empirically safer than humans clicking through prompts.

The resolution isn’t to pick a side. It’s to recognize that human review and autonomous agents serve different functions at different scales. The ReviewGuard MCP project holds the GitHub token server-side and simply doesn’t register the submit tool — the agent can draft but cannot publish without a human. That’s the pattern: let agents draft at machine speed, let humans control the publish boundary. Feature flags move the safety boundary from merge to rollout, as Rootly discovered, which is where blast radius actually gets contained.

How Should Teams Navigate the Ownership Contradictions?

Three contradictions define the current landscape, and none of them resolve cleanly.

Ownership vs. copyright existence. Copilot, Cursor, and Claude terms all assign output ownership to the user, and a dev.to framework argues that the human who ships AI-generated code owns the outcome and is responsible for correctness, security, and maintainability. But a SaaS law firm analysis notes that the foundational question of whether copyright exists in AI code remains unresolved. You may own the output contractually, but if no enforceable copyright attaches to it, ownership is a right to something with no legal substance.

Accessibility discount vs. data extraction. Meta frames the lower price as lowering barriers to entry. But the price spread between tiers — $1.15 per million input tokens — is an explicit bid for training data, and SourceFeed shows that agent prompts inherently contain entire repos. The discount isn’t a discount. It’s a transaction.

Human review vs. autonomous safety. Oracle has prohibited OpenJDK contributors from submitting any content generated by LLMs, citing IP, safety, and review concerns, per The Register. Meanwhile, Anthropic’s data shows auto mode is safer than manual review. Both can be true: autonomous agents with classifiers are safer than inattentive humans clicking prompts, but neither replaces governance for IP-sensitive codebases.

Enterprise AI data ownership involves three distinct types — input, training, and output data — each with separate ownership terms often obscured by vendors, per TechTarget. CIOs must demand specific contractual protections: no training on customer data, short retention windows, data isolation, output ownership rights, and audit capabilities. Vague “we don’t train on your data” clauses don’t prevent learning through usage patterns.

What Should Your Team Actually Do About AI Code Ownership?

Start with a data classification exercise. Tag every repository as public, proprietary, or regulated. Any proprietary or regulated codebase should never touch a contributor-tier or free-tier API that trains on prompts. Full stop. The 21x discount is not worth surrendering training rights on your entire worktree.

For proprietary work, enterprise zero-retention plans are the only safe default. GitHub Copilot’s IP indemnity gives it a structural edge for teams that need contractual defense against third-party claims. For teams already running hybrid stacks with multiple tools, our hybrid AI coding stack guide covers routing and hard spend caps — the cost control layer that prevents agent bursts from becoming data export events.

Implement provenance now, before you need it. The Korext ai-attestation standard and Pedigree project both offer open, Git-native approaches that don’t require vendor cooperation. Commit-level attribution metadata — tool, model version, prompt reference, human modification degree — is the minimum viable provenance layer. If you’re evaluating provenance tools, heuristic detection reaches only 20-25% accuracy, so client-side capture with cryptographic attestation is the only architecture that supports board audits or patent reviews, per Exceeds AI.

The question I keep coming back to: if a regulator or acquirer asked you today to prove which lines of your codebase were AI-generated, which models produced them, and what training-data rights you granted in the process — could you answer? Most teams can’t. The ones that build provenance and data-rights governance before they’re forced to will own their codebase in every sense that matters. The ones that don’t will discover that the cheapest tier they picked to save money was the most expensive decision they ever made.