Least Privilege, Identity and Privacy for Claude Agents

1.Least privilege: assume one layer will fail

Screens and prompt policies lower the odds that an injection succeeds. Secure-by-design deployment also asks what the attacker gets if one does. Anthropic's answer is least privilege: withhold secrets Claude does not need, run tools in sandboxed environments, and scope permissions as narrowly as you can. Then even a successful injection can do very little damage.

In Claude Code and the Agent SDK, least privilege is set through permission rules. Allow rules let a tool run without manual approval. Ask rules prompt for confirmation every time. Deny rules block the tool completely. Rules can name a whole tool (Bash, WebFetch, Read) or narrow it down, as in Read(./.env) or WebFetch(domain:example.com). Organisations can also set policies that apply to all their users.

{
  "permissions": {
    "allow": [
      "Bash(npm run *)",
      "Bash(git commit *)"
    ],
    "deny": [
      "Bash(git push *)"
    ]
  }
}

Know what this gate is and what it is not. Claude Code parses Bash commands into an AST and checks them against your rules, and anything unparseable or unmatched needs approval. The documentation says plainly that this is a permission gate and not a sandbox. Apart from a few built-in safety checks, it does not infer whether a command is dangerous from what it targets or what it does. A deny rule matches the command as written, so network enforcement that does not depend on the command text needs sandbox network isolation.

Sources123

2.Isolation and keeping credentials out of the agent

Below the permission gate sits the isolation layer. The secure-deployment guide compares four technologies. The choice is a trade-off between isolation strength, overhead and operational complexity, and the right answer depends on the threat model.

The sandbox runtime shares the host kernel, so a kernel vulnerability could in theory allow an escape. If you need kernel-level isolation, the guide points to gVisor or a separate VM. Whatever you choose, the hardening rule is the same: mount only the directories you need, read-only where possible, drop Linux capabilities, run as a non-root user, and never mount sensitive host directories such as ~/.ssh or ~/.aws.

Credentials get the same treatment. Instead of putting API keys inside the agent's environment, the guide recommends a proxy outside the container. The proxy injects credentials, enforces an allowlist of endpoints, and logs every request for audit. The agent never sees the real credentials, and they are stored in one secure location rather than copied into each agent. At the network level, agent containers go in a private subnet with no internet gateway, and firewall rules block all egress except to the proxy.

Sources2

3.Identity: short-lived tokens instead of static keys

A long-lived API key is a static secret: someone has to create it, store it in CI, rotate it, and hope it never leaks. Workload Identity Federation (WIF) removes that secret. Workloads authenticate to the Claude API with short-lived OIDC tokens from an identity provider you already run, such as AWS IAM, Google Cloud, GitHub Actions or Kubernetes. The SDK exchanges the provider's signed JWT for an Anthropic access token and refreshes it before it expires.

WIF supports least privilege and auditability in two ways. Because a service account holds credentials rather than being one, it is easier to audit which workload acted as which service account. And one issuer can carry many rules, one per team, namespace or permission level, each with its own scope. The docs also set a limit on what WIF achieves: federated authentication is only as strong as the upstream identity provider, so pair it with the IdP's own controls for defence in depth.

Sources4

4.Privacy controls in the design

Privacy is designed in from the start in the same way. When you pass per-user IDs to Anthropic so violations can be traced, hash them cryptographically to protect end users' privacy. Claude Code keeps API keys and tokens in the macOS Keychain when it is available, and protects them with file permissions on Windows and Linux. Anthropic's documented data protections include limited retention periods for sensitive information, restricted access to user session data, and user control over data-training preferences. A system prompt can also restate privacy as a value Claude must uphold, for example by telling it to protect all personal and corporate data.

Sources53

Exam traps

Each one states something that sounds right. Open it to see what is actually true.

1. 1.A permissions.deny rule for curl fully prevents an agent from reaching the network.Why is that wrong?

   Permission rules are a gate that matches command text. They are not a sandbox. For network enforcement that does not depend on how a command is written, use sandbox network isolation.

   Covered in Least privilege: assume one layer will fail

2. 2.Switching from API keys to Workload Identity Federation fully secures workload authentication.Why is that wrong?

   WIF removes static secrets, but it is only as strong as the upstream identity provider that signs the JWT. Pair it with the IdP's own controls.

   Covered in Identity: short-lived tokens instead of static keys

Practise it for real

Apply least privilege to a Claude Code project with allow and deny permission rules

1. 1.In your project's Claude Code settings, add a permissions block that allows Bash(npm run *) and Bash(git commit *) and denies Bash(git push *).

   Why: Routine build and commit work runs without prompts, while the one action that publishes changes is blocked.

   You should see: npm run commands run without a manual approval prompt.

2. 2.Ask Claude to push the current branch.

   Why: Checks that the deny rule is enforced and not just documented.

   You should see: The push is not executed, because deny rules prevent Claude Code from using the matched tool.

3. 3.Ask Claude to run npm install.

   Why: Bash(npm run *) matches npm run subcommands, not other npm commands. This shows how narrow the rule really is.

   You should see: npm install is not auto-approved and requires your approval.