Secure-by-Design Deployment: Least Privilege, Access Management, Secrets and Privacy

1.Least privilege: limit how much damage a mistake can do

Guardrails make an attack less likely to succeed. Secure-by-design deployment assumes some attacks will succeed anyway and limits what they can do. Anthropic's guidance says it directly: give Claude no secrets it doesn't need, run tools in sandboxes, and scope permissions as narrowly as you can.

In Claude Code and the Agent SDK, least privilege is expressed through permission rules. Allow rules run a tool without asking. Ask rules ask for confirmation every time. Deny rules block the tool completely. Rules can name a whole tool (Bash, WebFetch, Read) or one specific use of it (Read(./.env), WebFetch(domain:example.com)), and organizations can push policies to every user.

{
  "permissions": {
    "allow": [
      "Bash(npm run *)",
      "Bash(git commit *)"
    ],
    "deny": [
      "Bash(git push *)"
    ]
  }
}

Wildcards are easy to write too broadly. The * matches whatever text is in its position, and a missing space changes the result:

Permission rules are a gate, not a sandbox. Claude Code parses each Bash command and matches it against your rules. Apart from a few built-in checks, it does not judge whether a command is dangerous from its effects. To contain what a command can actually do, use OS-level sandboxing.

{
  "permissions": {
    " ? ": [
      "mcp__*"
    ]
  }
}

Sources123

2.Identity and access management: keep credentials away from the agent

For an agent, identity and access management mostly means keeping secrets out of its reach. Anthropic's secure-deployment guide recommends running a proxy outside the agent's environment, such as Envoy with its credential_injector filter. The proxy validates each request, enforces a domain allowlist, adds the credential and logs the traffic. The agent never sees the credential. Credentials live in one secure place instead of being copied to every agent, and you get an audit trail of every request. On the cloud side, give the agent's service account minimal IAM permissions, and block all egress except to the proxy.

Isolation backs this up. A hardened container drops privileges and mounts only what the agent needs:

Access management also covers the people and workloads that call the Claude API. In the Claude Console, a key's type decides who it acts as:

- A personal key acts as you, with your roles and permissions. - A service account key acts as a service account. - A workspace key is legacy. It acts as no one, and identity-backed keys or Workload Identity Federation are preferred.

Personal and service account keys are identity-backed. When the user or service account is removed from the organization, the key stops working, so keys don't outlive the people or workloads that own them. Use a personal key for your own development and scripts. For shared or automated workloads such as CI and production services, an organization admin creates a service account so the workload has its own identity. Don't share one person's key.

A key can also be scoped to a single workspace, where it works only in that workspace. For production workloads on cloud platforms or CI/CD, Workload Identity Federation exchanges your identity provider's token for a short-lived token, which removes the static secret.

Sources34

3.Storing, rotating and scanning for API keys

Your own Claude API key needs the same care. Anthropic's API key guidance says to load it from the environment instead of hard-coding it, as in the snippet below. In the cloud, use your hosting provider's mechanism for injecting environment variables. As the number of secrets grows, a Key Management System (KMS) gives you central encrypted storage, fine-grained access control, audit trails and simpler rotation.

from dotenv import load_dotenv

import os

load_dotenv()
my_api_key = os.getenv("ANTHROPIC_API_KEY")

Three habits keep the damage small if a key leaks:

- Rotate on a schedule, for example every 90 days, by creating new keys and deactivating old ones. Don't wait for a leak. - Use separate keys per environment (development, testing, production), so you can disable only the compromised one. - Scan for committed secrets. Turn on secret scanning in your source-control provider, use SAST tools such as Gitleaks, and put scanning in CI/CD so a secret is caught before it reaches the main branch.

Anthropic is also in GitHub's Secret scanning partner program. If a Claude API key turns up in a public repository, Anthropic deactivates it automatically and emails the owner. Agents can leak other secrets too: files such as .env, ~/.aws/credentials, ~/.kube/config and *.pem should never be mounted where an agent can read them.

Sources5

4.Privacy: data retention and zero data retention

Privacy by design starts with the prompt. The guardrail examples on Anthropic's jailbreak-mitigation page write data protection directly into the system prompt, for example "Protect client privacy; never disclose personal or financial data." The other half is the data's lifecycle: what the platform keeps, and for how long.

Data minimization is the underlying principle. Anthropic keeps only what is technically necessary for a feature to work, and conversation content (your prompts and Claude's outputs) is not retained by default. Retained API data is never used for model training without your express permission.

For stricter needs, Anthropic offers two data handling arrangements for the Claude API: zero data retention (ZDR) and HIPAA readiness. They are separate arrangements, and the feature eligibility table lists which API features each one covers. Under ZDR, Anthropic does not store prompts or responses at rest once the response is returned. Plan around a few details:

- ZDR is enabled per organization. A new organization needs it enabled separately. - Features marked "No" in the eligibility table, such as code execution, are not covered even though they use /v1/messages. - On Amazon Bedrock and Google Cloud's Agent Platform, the cloud provider is the data processor, so their controls apply instead.

Some retention sits outside both arrangements. The Activity Feed retains data for 6 years, and claude.ai chat, file and project content follows your organization's retention policy. Check which model applies before you promise users that data is not stored.

Sources61

Exam traps

Each one states something that sounds right. Open it to see what is actually true.

1. 1.A Bash deny rule or allowlist sandboxes the agent and contains what a command can do.Why is that wrong?

   Permission rules match command text. Claude Code says this is a permission gate, not a sandbox; use OS-level sandboxing to restrict filesystem and network access.

   Covered in Least privilege: limit how much damage a mistake can do

2. 2.API keys only need rotating after a suspected leak.Why is that wrong?

   Anthropic recommends rotating on a consistent schedule, such as every 90 days, so a key that is compromised without anyone noticing has a limited lifetime.

   Covered in Storing, rotating and scanning for API keys