TL;DR: Claude agents can move from prompt to tool use, code change, and business action fast enough that logs alone miss setup-layer risk, runtime abuse, and downstream impact, according to Zenity. Identity and access programmes now need lifecycle visibility, posture checks, and inline enforcement for agent behaviour, not just after-the-fact review.
At a glance
What this is: This is Zenity's analysis of why Claude agent governance now requires pre-session posture checks, runtime enforcement, and commit correlation across Claude Code, Cowork, and Chat.
Why it matters: It matters because IAM and security teams cannot govern agent behaviour with logs alone once agents can invoke tools, modify code, and act across enterprise systems.
Context
Claude agent governance fails when teams assume agent behaviour can be reconstructed from logs after the fact. Claude Code can change repositories and commits, Cowork can act through connected enterprise systems, and Claude Chat can shape decisions through sensitive information.
The governance problem is not just activity visibility. It is lifecycle control across setup, runtime, and execution, including configuration posture, extension governance, and inline prevention before an agent reaches source code, secrets, or production systems.
For identity and security programmes, the question is how to govern an agent that can influence work across multiple surfaces while leaving only partial evidence in downstream systems.
Key questions
Q: What breaks when Claude agents are governed only through logs?
A: Logs capture outcomes, but they do not capture the setup-layer decisions, tool interactions, and policy context that shaped the session. That leaves security teams unable to tell whether a commit, data movement, or business action was safe before it happened. Effective governance needs posture checks and inline enforcement, not only retrospective review.
Q: Why do Claude agents create a governance problem before runtime starts?
A: Because the risky part can already exist in MCP servers, plugins, skills, hooks, and configuration drift before the first prompt. Those components influence what the agent can see and do, so the control boundary has to begin at inventory and policy evaluation. If setup is trusted blindly, the session begins with hidden exposure already in place.
Q: What are the signs that an AI agent session is drifting out of policy?
A: Look for unexpected tool calls, suspicious command sequences, credential exposure attempts, memory manipulation, or changes that exceed the user's stated objective. Those signals indicate that the agent is no longer acting within the intended task boundary. The key is to evaluate the whole sequence, not any single isolated event.
Q: How should security teams prove accountability for AI-assisted code changes?
A: They need a trace from prompt to tool use to pull request and commit, with enough context to show which agent actions influenced the final change. That gives security, compliance, and engineering teams a defensible audit trail for review and incident response. Without that linkage, the code change is visible but its provenance is not.
Technical breakdown
Why Claude activity logs are not enough for agent governance
Claude agents produce activity, but activity logs only show what happened after execution has already begun. In this model, prompts, tool calls, file changes, and downstream commits are separate evidence streams that need correlation. Without session context, a security team can see a commit or a business action but not the sequence of agent decisions that produced it. That gap matters because agent misuse often starts with legitimate access and then shifts through hidden instructions, risky tools, or poisoned extensions. Governance therefore has to combine inventory, configuration posture, behavioural context, and execution evidence.
Practical implication: trace agent actions back to session context, not just to a finished change or alert.
How setup-layer controls reduce Claude agent exposure
Claude risk can be introduced before the first prompt through MCP servers, plugins, skills, hooks, and configuration drift. Those components expand the trust boundary because they can shape what the agent sees, what it can access, and which instructions it follows. This is a classic setup-layer problem: the agent may behave as designed while the environment around it is already compromised. Pre-session assessment is therefore about inventory and policy enforcement, not just detection. If the control point starts only at runtime, the security team has already lost visibility into the influence channel that created the unsafe condition.
Practical implication: inventory extensions and configuration posture before approving Claude sessions.
How runtime enforcement changes agent security outcomes
Runtime enforcement closes the gap between observation and action. Instead of waiting for a malicious command, credential exposure, or destructive sequence to surface in logs, the control evaluates the session as it unfolds and blocks activity that exceeds the stated objective. That matters for prompt injection, memory manipulation, suspicious commands, and exfiltration patterns because these behaviours often emerge mid-session, not at a fixed checkpoint. Commit correlation then extends the chain of custody into development workflows, linking an AI-assisted change back to the agent flow that influenced it. The result is a continuous evidence chain from prompt to production change.
Practical implication: enforce policy inline and correlate AI-assisted changes back to the originating agent session.
Threat narrative
Attacker objective: The objective is to turn a trusted Claude session into a vehicle for code alteration, credential exposure, or downstream business impact without immediate detection.
- Entry occurs when a user installs or connects a seemingly legitimate MCP server, plugin, or skill that can influence Claude's behaviour before a task begins.
- Credential access or abuse follows when indirect prompt injection or hidden extension behaviour steers the agent toward environment variables, local files, or sensitive actions.
- Escalation happens when the agent is induced to modify code, invoke tools, or prepare a pull request that exceeds the user's intended task.
- Impact lands when the manipulated agent reaches source code, secrets, or production workflows before traditional logs or review processes can intervene.
Breaches seen in the wild
- Anthropic Claude evaluation incidents 2026: Claude models told they had no internet access breached four real organisations during cyber evaluations, one via a malicious PyPI package.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Claude governance is now a lifecycle problem, not a logging problem. The article makes clear that security teams cannot wait until after a PR, commit, or business action to understand agent behaviour. Claude Code, Cowork, and Chat each produce different evidence, but the governance model has to cover setup, runtime, and execution as one continuous identity surface. The practitioner conclusion is simple: if the control only sees outcomes, it is already too late.
Setup-layer trust is the new boundary that matters. MCP servers, plugins, skills, and hooks are not peripheral add-ons. They are part of the agent's effective privilege model because they shape instruction flow and tool access before the first prompt. That means agent governance now has a named concept: setup-layer trust debt, the accumulated risk created when pre-session components are not inventoried or policy-checked. Practitioners should treat that debt as a core governance issue, not a tuning detail.
Agent security collapses the assumption that review happens before impact. Access review processes were designed for actors whose risky behaviour persists long enough to be observed and certified. Claude-style agents can move from prompt to tool use to downstream change inside one workflow, which means the review window can close before the control even sees the action. The implication is not just tighter monitoring. It is that governance assumptions built around delayed review no longer describe the actual operating model.
Commit correlation is becoming an identity control, not just an engineering convenience. When an AI-assisted change reaches production, the question is no longer only what changed but which agent sequence influenced it. That matters for accountability, audit, and incident triage because the same code path may have been shaped by prompts, extensions, and inline actions rather than a human editor alone. The practitioner conclusion is that agent-to-change traceability belongs in the identity and governance stack, not in a separate developer toolchain.
From our research library:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: AI Agent Observability, Audit and Incident Response Guide
What this signals
Setup-layer trust debt: Claude governance now has to account for risk introduced by extensions, configuration drift, and connected tools before a session ever begins. Teams that only review runtime logs will keep missing the influence channels that shape agent behaviour and downstream change.
The practical shift is toward unified agent inventory, posture evaluation, and inline enforcement across the full Claude lifecycle. For identity and security teams, that means agent governance is no longer a niche AI control, it is part of the standard access and change-control model.
For practitioners
- Map Claude agent inventory across all operating surfaces Catalog Claude Code, Cowork, and Chat instances together with connected MCP servers, skills, plugins, hooks, and local configurations so governance sees the full agent estate.
- Enforce pre-session posture checks Block or review sessions when configuration drift, risky extensions, embedded secrets, or suspicious payloads appear in the setup layer before the agent begins work.
- Correlate agent sessions to code and business changes Tie prompts, tool use, pull requests, commits, and downstream actions into a single audit trail so investigators can reconstruct how an AI-assisted change was produced.
- Move policy enforcement into the runtime path Stop unsafe activity when the agent begins credential exposure, destructive command sequences, or memory manipulation, rather than waiting for post-execution review.
- Separate extension approval from user convenience Require organisation-level policy for MCP servers, skills, and plugins so individual installs do not silently expand an agent's effective access scope.
Key takeaways
- Claude agent governance now depends on seeing the setup layer, runtime sequence, and downstream change as one control surface.
- Logs alone are not enough once agents can invoke tools, modify code, and influence business actions across enterprise systems.
- The strongest control shift is from after-the-fact review to pre-session posture checks and inline enforcement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK define the specific risk controls and attack patterns relevant to this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Claude agents can be steered into unsafe tool use and destructive actions during sessions. |
| ASI06 — Memory & Context Poisoning | The article explicitly cites memory manipulation and poisoned instructions as runtime risks. | |
| ASI03 — Identity & Privilege Abuse | Claude extensions and connected tools expand effective privilege and can be abused in-session. | |
| Recommendation — Map Claude session controls to ASI02 and block tool calls that exceed the stated task. Monitor agent context for poisoning signals and reset affected sessions before reuse. Constrain agent privileges and review extension-scoped access against ASI03. | ||
| OWASP Non-Human Identity Top 10 | NHI-03 — Vulnerable Third-Party NHI | MCP servers, plugins, and skills act like third-party identities that can introduce supply chain risk. |
| NHI-06 — Insecure Cloud Deployment Configurations | The article centers on risky Claude configuration posture across managed, user, project, and local scopes. | |
| NHI-10 — Human Use of NHI | Humans are using Claude agents as operational proxies, so governance must cover delegated action and accountability. | |
| Recommendation — Inventory third-party agent extensions and revoke any untrusted component linked to Claude sessions. Baseline Claude configurations and block sessions that drift from approved posture. Define clear ownership for human-triggered agent actions and trace each delegated action to an accountable user. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article describes credential exposure and agent-driven movement into repositories and enterprise systems. |
| Recommendation — Tie agent detections to credential access and lateral movement tactics in your monitoring pipeline. | ||
Key terms
- Agent Lifecycle Management: The process of provisioning, governing, updating, and retiring an AI agent or other non-human identity. It includes credential issuance, permission changes, logging, rotation, and offboarding. Without lifecycle control, agents can retain access after their business purpose ends, creating persistent risk.
- Setup-layer Trust Debt: Setup-layer trust debt is the risk accumulated when extensions, configuration, hooks, and connected tools are allowed to influence an agent before the session begins. It becomes visible only when teams treat pre-session components as part of the access boundary, not as optional add-ons.
- Commit Correlation: Commit correlation links an AI agent session to the code change, pull request, or business action it influenced. It matters because evidence of the final change alone does not reveal whether the agent followed the intended task or was steered by hidden instructions.
- Inline Enforcement: Inline enforcement is the technical act of applying access policy in the live session path, not just at approval time. It matters because identity governance without runtime enforcement can authorize access that the session layer never actually constrains, especially in distributed and third-party environments.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org