Enterprise AI agent security
Claude Code credential access
If a developer can read a credential, Claude Code often can too — unless you enforce a different permission boundary for the autonomous actor. Credential access is the fastest path from "helpful coding assistant" to incident.
Control point
Separate the developer’s authority from the coding agent’s — enforce at shell, MCP, and file operations.
Developer session
Human intent
Coding agent
Claude Code · Cursor · Codex
Repo & tests
Typically allow
Credentials
Agent block
Prove exposure in your environment
The AI Agent Exposure Assessment runs Audit Mode on a pilot developer group for fourteen days and delivers evidence your security leadership can act on — then you enforce what matters.
Get your exposure reportTypical failure mode
- •Agent asked to "fix the deploy" reads ~/.ssh, .aws, or vault-export files.
- •Tool and shell access reuse the user's identity without a narrower agent scope.
- •Alerts fire after exfiltration; nothing blocked the read at attempt time.
Control model
- •Human allow, agent block on sensitive paths and secret stores.
- •Normalize actions (read, write, exec) independent of prompt wording.
- •Record every decision for audit and CISO reporting.
Common questions
Can we allow Claude Code in the repo but deny credential files?
Yes. Policy attaches to actor context — the same human may read a key while the agent session is blocked from that path.
Related