A Guide to Claude Code Security and Governance

Claude Code security involves managing the unique risks of running local AI agents directly on developer endpoints. Securing these environments requires a multi-layered approach that combines endpoint telemetry, identity governance, and Anthropic’s new Compliance API to monitor local file access, bash command execution, and third-party tool connections.

Claude Code is fundamentally changing how developers work by moving AI from browser tabs directly onto their local machines. This shift, while powerful for productivity, introduces significant new security challenges that organizations must understand and address.

The Shift to Local AI Agents

Claude Code acts as a “harness” running locally on a developer’s endpoint. Unlike a simple web-based chatbot, this local harness is a sophisticated orchestrator.

Think of the cloud-based Large Language Model (LLM) as the brain—it processes information and makes decisions. The local harness (Claude Code) acts as the body, providing the hands and sensory organs. The harness is what reads local files, executes bash commands, and connects to third-party tools via Model Context Protocol (MCP) servers, using the credentials available on that specific machine.

Because the LLM itself doesn’t maintain the state of the interaction, the local harness must repeatedly send all necessary context to the cloud model for every single action.

Key Insight: The security model must adapt because the execution of commands and access to data happens locally, not in a centralized cloud environment where traditional SaaS controls apply.

The Visibility Gap in Claude Code Security

This decentralized approach means that standard cloud security tools lack visibility into what these local agents are doing. According to a recent survey, local agents account for 68.6% of AI agents discovered in customer environments, and 82% of professionals found agents they didn’t know existed.

Layer 1: Managed Settings (The Policy Baseline)

Anthropic provides managed settings via configuration files on the endpoint (JSON on Mac/Linux, registry on Windows). These allow administrators to enforce static baselines, such as allow/deny lists for MCP servers or regex restrictions on bash commands.

The catch: Static policies are rigid. They don’t understand context or intent, which can frustrate developers without completely mitigating risks.

Layer 2: Anthropic’s Compliance API

Introduced in August 2026, Anthropic’s new Compliance API provides crucial visibility into local sessions. Because the local harness sends full context to the model on every turn, anything the model processes is logged. These transcripts log user prompts, bash commands, file reads/writes, and MCP commands.

The catch: The API only logs what is sent to Anthropic’s models. Actions that happen locally but don’t reach the LLM (like local pre-execution hooks) remain invisible here. Additionally, this data can contain sensitive information like PII or secrets and must be stored securely.

Layer 3: Endpoint Telemetry

Neither managed settings nor the API can see what is sitting passively on the local disk. You need Endpoint Detection and Response (EDR) or similar endpoint agents to discover scattered configuration files, identify installed skills and plugins (even if they haven’t been used yet), and correlate API logs with actual local processes to catch risky behavior.

The Missing Piece: Identity and AI Agent Governance

While these three layers are necessary, they still aren’t enough on their own. The critical missing layer in local harness security is business context and identity.

An admin looking at a transcript cannot easily tell if a downloaded plugin is a legitimate tool approved by engineering or a malicious script pulled from the internet. True AI agent governance requires connecting the telemetry signals to the agent’s owner, their identity, their intent, and their authorized permissions.

Conclusion

As development teams rapidly adopt local AI tools, securing the execution environment has never been more critical. Relying on basic cloud controls is no longer sufficient. Organizations must implement a comprehensive strategy that ties endpoint telemetry and the Anthropic Compliance API back to user identity and intent. Only with this context can organizations ensure least-privilege access and maintain robust Claude Code security.

Working with Data and AI? Contact the Cloudberry360 team today to see how Cloudberry360 provides enterprise-grade, responsible generative AI solutions and services to accelerate your innovation.

Frequently Asked Questions

1. What is Claude Code? Claude Code is a local AI harness that runs directly on a developer’s machine. It acts as an orchestrator that can read local files, execute bash commands, and connect to third-party tools to assist with software development.

2. Why is Claude Code security so important? Because Claude Code runs locally and executes commands using the developer’s credentials, standard cloud security tools cannot properly monitor it. If left unsecured, it can expose sensitive local files, execute unauthorized commands, or connect to malicious plugins.

3. What is the Anthropic Compliance API? The Anthropic Compliance API is a tool introduced to provide visibility into local AI sessions. It logs transcripts of what the local harness sends to the cloud model, including user prompts, file reads, and bash commands.

4. Can traditional cloud security tools govern local AI agents? No, traditional cloud tools lack visibility into endpoint-level executions. Securing local agents requires a combination of endpoint telemetry (EDR), managed configuration files, and identity governance to ensure full visibility.