Z.ai disabled affected features of its ZCode coding assistant after developers raised concerns that local workspace and repository information was being uploaded to cloud infrastructure without the consent they expected.
Z.ai apologized and took remediation steps, including disabling affected functionality. The incident highlights an authority distinction that becomes increasingly important as coding agents index, summarize and reason over enterprise repositories.
Read authority is not transfer authority
A developer may authorize an AI coding assistant to read a local repository.
That does not automatically authorize the assistant to copy that repository to another cloud service, model provider, vector database or processing environment.
Those are materially different effects.
Authority to read data does not imply authority to move that data across a boundary.
Data boundaries are consequential effects
Changes in processor, data residency, organizational boundary, geography, retention regime or downstream recipient should be treated as authority-relevant effects rather than hidden implementation details.
For GitHub and other software-development environments, this distinction is especially important. Repository access should not silently become external persistence, indexing, training or disclosure.
Technical necessity does not manufacture enterprise authority.
Sources
NEXT STEP