Governing Claude across chat, code and agents needs runtime controls

At a glance

What this is: Lumia Security argues that Claude governance now has to cover chat, coding, file handling, connected tools and agentic actions, not just prompts.

Why it matters: IAM and AI governance teams need runtime controls that evaluate context, purpose and account state, because permissions alone do not determine whether an AI use case is acceptable.

Context

Claude has moved from a conversational interface into a workflow layer that can reach files, code repositories, business systems and external tools. That creates a governance problem that sits between identity, data protection and AI control, because access rights alone do not answer whether a particular use is acceptable.

The practical issue is not only who can use Claude, but what they can disclose, which account they use, what connectors or MCP servers are involved, and what actions an agent can take. That makes this a AI governance problem as much as a security one.

Key questions

Q: How should organisations govern AI assistants that can read and act on inbox messages?

A: They should define those assistants as delegated non-human identities with explicit message scope, action scope, and escalation limits. The goal is to prevent natural-language instructions from becoming unauthorised workflow triggers. Review what the agent can read, what it can do, and what requires human confirmation.

Q: Why do permissions alone not control risky AI use?

A: Permissions only answer whether access exists. They do not tell you whether disclosure, reuse, delegation or downstream action is acceptable for the specific purpose and context. That is why AI governance needs policy logic that evaluates the employee, data, workflow and intended action together, not just the entitlement grant.

Q: How should security teams govern personal AI assistants that act on behalf of employees?

A: Treat each assistant as a distinct non-human actor with its own identity, policy scope, and audit trail. Human delegation alone is not enough when the assistant can move across email, documents, calendars, and internal systems. Governance should bind the sponsor, the executor, and the target resource so access reviews and investigations can separate request from action.

Q: How should organisations enforce AI policy compliance across employee and agent use?

A: Start by classifying AI usage by identity type, data sensitivity, and execution context, then enforce policy at runtime rather than only through written rules. Human users, enterprise copilots, and autonomous agents should not share the same control path if they can process different data or take different actions. The goal is visible, auditable behaviour control.

Technical breakdown

Why permissions do not equal policy approval

Traditional access control can answer whether a user or agent can reach a file, system or connector, but it cannot decide whether the intended use is allowed. That distinction matters when an employee is authorised to access a salary spreadsheet yet not authorised to send it to an external model, reuse it for a different purpose, or let an agent act on its contents. AI governance has to evaluate purpose, data sensitivity, account context and downstream action, not just entitlement. See the AI Governance Guide.

Practical implication: Treat authorisation as a prerequisite, not a decision rule, and add policy checks that can block or reshape disallowed AI actions.

How runtime controls enforce AI policy in the flow of work

A usable governance layer inspects prompts, files, attachments and responses before data leaves the organisation’s control boundary. That includes blocking prohibited transfers, redacting sensitive values such as credentials or payment data, and warning users when a request needs justification or a different workflow. The important point is timing: the control acts before disclosure or agent execution, which is the only moment when policy can still prevent harm rather than document it afterwards.

Practical implication: Place enforcement in the request path so the system can redact, warn or stop risky AI use before data is exposed.

Why Claude governance must include model routing and cost controls

Governance is not only about security restrictions. When users can freely choose advanced models, organisations lose visibility into why expensive models were used, whether the choice was justified, and whether the consumption was approved. That creates a control gap between operational governance and financial governance. Model selection therefore belongs in the same policy layer as data handling, because the organisation needs to know when a premium model is necessary and when it is simply overused.

Practical implication: Add model-selection rules to the same governance policy so teams can justify premium usage and spot unmanaged spend.

Threat narrative

Attacker objective: The objective is to move sensitive data or actions through an AI workflow that the organisation would not have approved if the request had been evaluated in context.

1. Entry occurs when an employee submits sensitive prompts, files or attachments into Claude through chat, code or connected workflows.
2. Credential and data exposure follow when those materials include protected information, such as passwords, payment data or other regulated content.
3. Escalation happens when Claude or an agent is allowed to act through connected tools or MCP servers without a policy check on the requested action.
4. Impact is policy breach, data disclosure or unauthorised downstream execution across enterprise systems.

Breaches seen in the wild

• OmniGPT breach claim 2025: A hacker claims to have leaked 34 million OmniGPT AI chat messages holding users' API keys and credentials; OmniGPT has not confirmed it.
• Meta AI Instagram Account Takeover: 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Claude governance is now an AI access problem, not just a prompt-safety problem. Once an AI system can read files, reach business tools and act through agents, the governance question shifts from content moderation to decision control. That means security teams have to govern account state, data classification, action scope and approval context together. The useful unit of control is no longer the prompt; it is the end-to-end interaction.

Context-aware enforcement is the missing control layer in most AI programmes. Policy statements can describe acceptable use, but they do not stop a payroll file from being uploaded or an agent from taking a prohibited action. The article’s key point is that policy must be operationalised at runtime with inspection, redaction, warnings and blocking based on employee, data and intended purpose. That is the control boundary where governance becomes real.

Agentic AI creates a new governance debt for IAM teams. When an AI system can execute actions on behalf of employees, the organisation must treat identity, delegation and action approval as one design problem. This is exactly where agent identity governance becomes important, because the central question is not just who signed in, but what the agent is authorised to do and under whose authority it acts. The practitioner implication is to govern delegated action, not just authentication.

Model selection is a governance decision, not just a usage preference. If employees can default to premium models without justification, the organisation loses both cost discipline and policy consistency. That matters because advanced models are often reserved for higher-risk or higher-value tasks, which means routing decisions should be visible, justified and auditable. Practitioners should treat model choice as part of the governance ledger, not an informal user preference.

From our research library:

• 63% of organisations surveyed lacked AI governance policies to manage AI or prevent shadow AI, according to IBM's 2025 Cost of a Data Breach Report.
• Read next: Identity Governance for AI Agents Guide

What this signals

AI governance will increasingly sit inside identity and workflow controls. As assistants move from answering questions to handling files and invoking tools, organisations will need governance that understands account state, data class and authorised purpose in the same decision. That shifts the programme from static policy to continuous enforcement, with the strongest controls applied at request time rather than after the fact.

Data minimisation becomes a practical control, not a privacy slogan. If a user can achieve the task with aggregated or anonymised data, then passing the full file to an AI service should be treated as an avoidable governance failure, not a harmless convenience. The programme implication is simple: make the least-disclosing path the easiest path, and measure whether policy exceptions are actually shrinking.

For practitioners

• Define acceptable Claude use by workflow, not by product alone Specify approved products, accounts, data types, connected tools and agent actions, plus when premium models require justification or approval.
• Enforce policy before data leaves the environment Use runtime controls to inspect prompts and files, block prohibited transfers, and redact sensitive values such as credentials or payment data.
• Separate corporate and personal usage decisions Require the system to identify which account is in use and apply different rules to enterprise-approved and personal access paths.
• Govern connectors and MCP servers as privileged integrations Review which tools, connectors and MCP servers Claude can access, because they can extend AI behaviour into systems with real business impact.
• Add model-routing rules to the policy layer Document when advanced models are justified, warn on unnecessary premium use, and create records that support audit and budget oversight.

Key takeaways

• Claude governance has expanded from prompt oversight to control of files, connectors, agent actions and model choice.
• The article’s core warning is that permissions do not determine whether a specific AI use is appropriate, so policy must be enforced in real time.
• For practitioners, the decisive move is to combine account-aware governance, content inspection and action blocking before sensitive data reaches the model.

Related NHI Mgmt Group resources: AI Governance Guide · Agentic AI Identity Guide · NHI Authentication Guide · Identity Governance for AI Agents Guide

Key terms

• AI Governance: AI governance is the set of controls used to discover, classify, approve, restrict, monitor, and revoke AI-enabled access. It connects identity, data, and policy so organisations can manage what AI can reach, what it can share, and when it should be stopped.
• Agentic workflow: An agentic workflow is a sequence of tasks executed by an AI agent with some level of tool access and decision authority. In security terms, the workflow matters because it can span multiple systems, identities, and permissions, which makes attribution and revocation harder than with ordinary automation.
• Context-aware Enforcement: Context-aware enforcement is policy that changes based on live conditions such as data sensitivity, environment, or task type. For AI agents, it is the difference between a static permission grant and a control that adapts to what the agent is trying to do right now.
• Model Routing Layer: The model routing layer is the policy and orchestration logic that decides which model handles a request, when to escalate, and what tools the request can reach. In AI programmes, it behaves like a control plane because it shapes data exposure, privilege boundaries, and auditability.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and workload identity. It helps practitioners translate identity control into operational policy for modern AI systems.