Latest
ResearchAn Open Letter to Dario AmodeiResearchAnnouncing State of Enterprise Agent Permissions 2026ResearchClaude Code Security Benchmark: What It Can Access on a Typical Developer LaptopReportState of Enterprise Agent Permissions 2026Research10 Actions Your EDR May Allow an AI Coding Agent to PerformResearchCISO Guide to Agent Least PrivilegeResearchAI Agent Exposure Assessment ChecklistResearchClaude Code vs Human Permissions: What Should Be Different?
Back to Blog
Claude Code vs Human Permissions: What Should Be Different?

Claude Code vs Human Permissions: What Should Be Different?

Same identity, different actor: which permissions should differ between a developer and Claude Code on the same laptop — and how to enforce the gap at runtime.

The 1stProtect Team Sep 9, 2026 9 min read

Claude Code vs Human Permissions: What Should Be Different?

When Alice opens Claude Code on her laptop, two actors share one login context:

  • Alice (human) — accountable, intentional, can use break-glass privileges under policy.
  • Claude Code (autonomous) — high-volume, prompt-driven, non-deterministic; should not inherit Alice’s full authority by default.

Security programs that treat both as “Alice’s user account” will over-privilege every agent session.

What should stay the same

  • Access to the task-scoped repo and dependencies needed to implement a ticket
  • Test runners, linters, and approved package registries
  • Internal documentation MCP tools when scoped to non-secret content
  • Identity for audit — which human launched the session

What should differ (typical enterprise)

CapabilityHuman (Alice)Autonomous (Claude Code)
Read source in assigned reposALLOWALLOW
Read ~/.sshALLOW (often)BLOCK
Read cloud provider credsALLOW (often)BLOCK
Run destructive prod commandsGOVERNEDBLOCK
Arbitrary MCP shellN/AAUDIT → BLOCK
Unknown external egressGOVERNEDBLOCK or AUDIT

“Should differ” is not a moral judgment on developers — it reflects blast radius. Alice can be trained and accountable; the agent is software that can be manipulated at machine speed.

Why RBAC alone does not solve this

Enterprise IAM answers who is Alice. It does not natively answer whether this shell read is Alice or Claude Code attempting the read. Runtime enforcement must:

  1. Attribute autonomous actor vs interactive human session
  2. Normalize actions (read, exec, connect, tool invoke)
  3. Return ALLOW / BLOCK / AUDIT locally at attempt time

Implementation sequence

  1. Audit Mode — Prove where Claude Code’s behavior exceeds intended scope today.
  2. Policy — Encode human vs agent rules on sensitive classes first (credentials, prod, egress).
  3. Prevent — Enable block on proven boundaries; keep repo work flowing.
  4. Evidence — Feed decisions to SIEM for leadership reporting.

FAQ

Should we ban Claude Code? No — define boundaries and enforce. Velocity with control beats shadow tooling.

Does the vendor safety layer replace this? Vendor guardrails help; they do not replace your credential and production rules on the endpoint.

How do we prove the gap? Exposure assessment on a pilot team — fourteen days of attributed telemetry.

See the live permission model on the homepage Alice vs agent table, or explore /use-cases/ai-coding-agents.