Intent monitoring for Claude Code exposes the NHI visibility gap

At a glance

What this is: Entro Security describes agentic intent monitoring for Claude Code as a way to expose session-level actions, identity use, and MCP activity that security teams currently cannot see.

Why it matters: For IAM, PAM, and NHI practitioners, the issue is that agentic development tools now behave like identities with access and action chains that need attribution, review, and anomaly detection.

Context

Claude Code and similar agentic tools sit inside development workflows but operate as non-human identities when they authenticate to services, access repositories, and call MCP servers. The governance problem is not only what they can do, but that most security and IAM teams cannot see which identity did it, what sequence of actions occurred, or whether a secret was exposed during the session.

That creates an NHI visibility gap. Traditional developer tooling assumes a human operator is the stable subject of the activity, while agentic sessions can chain prompts, tool calls, and remote requests fast enough that logs become fragmented unless they are correlated at the identity and intent level.

Key questions

Q: What fails when Claude Code sessions have no identity-level visibility?

A: Security teams lose the ability to tell which human started the session, which non-human identity acted, and whether the agent touched secrets or sensitive systems. That makes incident review, accountability, and governance far weaker because the activity arrives as disconnected tool events instead of a traceable identity sequence.

Q: Why do agentic development tools create more governance risk than ordinary developer tools?

A: They can make independent tool calls at machine speed and chain those calls through authenticated identities. That changes the risk because the operator is no longer a single human action, but a session that may combine prompts, external requests, and privileged access before anyone can inspect the full path.

Q: How do security teams know if coding agent monitoring is actually working?

A: Monitoring is working when it can correlate session behavior, file access, tool use, and network attempts into a single investigative trail. Useful signals include taint tracking after sensitive file access, anomaly detection after external content ingestion, and alerts on writes to restricted paths. If those patterns are visible, the program can distinguish intended work from manipulated behavior.

Q: How should organisations govern AI agent access to repositories and MCP servers?

A: Treat those connections as governed identity pathways, not casual tooling integrations. Define which identities may authenticate, record every session context, and review the downstream tools an agent can reach so repository access, API use, and MCP activity remain attributable and bounded.

How it works in practice

Why session-level logging fails for agentic CLI tools

Agentic CLIs do not behave like ordinary developer utilities because they can sequence prompts, tool calls, and remote requests within a single interaction. If logs only record isolated API events, the security team sees activity fragments but loses the session context that explains who initiated it, which NHI authenticated, and whether the sequence was ordinary or risky. That matters for attribution because the same action can be benign in one intent chain and suspicious in another. In practice, auditability has to capture the human trigger, the machine identity used, and the full request-response trail as one evidence set.

Practical implication: Correlate prompts, tool calls, and identity usage into a single session record before you try to investigate agentic activity.

How intent classification changes NHI monitoring

Intent classification adds meaning to activity logs by grouping many small actions into a larger task narrative. In this article's model, the point is not just to know that Claude Code read files or called an MCP server, but to determine whether the sequence resembles refactoring, reconnaissance, secret handling, or another operational pattern. That is a governance shift because NHI oversight has traditionally focused on entitlement and rotation, while agentic oversight also needs behavioural context. Without that layer, the same permissions can look harmless until the session is already far enough along to expose data or trigger an unwanted action.

Practical implication: Use intent as a control layer above raw event logging so you can distinguish normal task execution from risky agent behaviour.

What MCP visibility adds to agentic identity control

MCP servers extend the action surface of an agentic tool by connecting it to external data sources and services. That means the identity question is no longer just which token the agent used, but which remote systems it touched, in what order, and with what request context. For NHI governance, that matters because the MCP layer can conceal high-risk access behind ordinary developer workflows unless it is monitored separately. A usable control model therefore has to record both the local session and the downstream MCP interactions that transformed a prompt into an action chain.

Practical implication: Treat MCP traffic as part of the identity record, not as generic application telemetry.

NHI Mgmt Group analysis

NHI visibility is now a session problem, not just an entitlement problem: Claude Code-style tools can combine prompts, tools, and remote calls inside one interaction, which means the control issue is no longer only who has access at provisioning time. The real gap is whether security teams can reconstruct what the agent actually did before the session ends. That shifts identity governance toward evidence capture at runtime.

Agentic intent monitoring creates the missing audit layer for non-human identities: Logging raw calls is insufficient when the value lies in understanding why a sequence of actions occurred. Intent is the bridge between event telemetry and identity governance because it turns disconnected actions into an accountable session narrative. Practitioners should treat that narrative as part of the control surface, not as forensic decoration.

MCP expands the identity perimeter into downstream tool ecosystems: Once agents can call external servers, the identity record has to extend beyond the local CLI and into the services it touches. That is a governance change for NHI programmes because access review, anomaly detection, and incident reconstruction all depend on seeing the remote context. The implication is that tool connectivity must be monitored as identity behaviour, not as generic integration traffic.

Visibility gaps matter because machine-speed action compresses the review window: Traditional review models assume there is enough time to observe, classify, and investigate activity after it occurs. Agentic systems can complete dozens of decisions before that window closes, which means governance based only on retrospective review will lag the actual risk. Practitioners need to design for runtime attribution, not post hoc explanation.

Intent monitoring is becoming a named control pattern for agentic identity governance: The market is moving toward controls that join human initiation, NHI authentication, and action-level context in one place. That is a sign that AI agent oversight is converging with NHI governance rather than replacing it. Teams should expect future programme maturity to be measured by how well they can tie agent behaviour back to a verifiable identity trail.

From our research library:

• 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Intent monitoring is becoming the control point for agentic sessions: Security teams cannot govern what they cannot attribute, and agentic tools collapse prompts, actions, and remote calls into a short-lived session that standard logs do not explain. The programme implication is that identity telemetry has to become session-aware before agentic adoption spreads further. According to the 2026 Infrastructure Identity Survey, 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, which makes runtime observability a near-term requirement rather than a future concern.

Session provenance matters more than tool counts: Once an agent can touch repositories and external servers, the security question is who initiated the task, which non-human identity was used, and what downstream systems were contacted. That means governance teams should build around provenance and intent, not around one-off alerting on isolated events.

For practitioners

• Instrument agent sessions with identity correlation Capture the human initiator, the non-human identity used, the prompts issued, and the downstream tool calls as one joined record.
• Separate intent from raw event telemetry Classify sessions into task narratives such as refactoring, secret handling, or reconnaissance so investigations start with context, not log noise.
• Log MCP requests and responses as identity evidence Record the remote server touched, the request chain, and the response context so MCP traffic becomes part of the audit trail.
• Review privileged AI agent use cases for scope drift Identify where agent sessions can reach repositories, secrets, or API calls that exceed the original developer task and require tighter oversight.

Key takeaways

• Claude Code-style sessions expose a structural gap in NHI governance because ordinary logs do not show which identity acted, what was touched, or why the agent made those calls.
• The article points to machine-speed session behaviour as the scale problem, with the control challenge centred on attribution and intent rather than simple event capture.
• The limiting control is joined session visibility, where human initiator, NHI authentication, and MCP activity are correlated before the session disappears from view.

Key terms

• Agentic intent monitoring: The practice of capturing and classifying an AI agent session so security teams can understand both what it did and why it did it. In agentic environments, intent monitoring joins prompts, tool calls, and downstream requests into one accountable narrative for governance and investigation.
• MCP Visibility: MCP visibility is the ability to observe Model Context Protocol connections between AI systems and the tools or data sources they can reach. It matters because many governance failures happen after the prompt, when agents invoke external tools and trigger actions outside the original interface.
• Session provenance: The evidence chain that links a session back to the human initiator, the non-human identity used, and the systems touched during execution. In agentic environments, provenance is what turns activity into attributable identity behaviour instead of an opaque sequence of events.
• Identity Attribution: Identity attribution is the ability to determine which entity performed an action and under what authority. For AI agents, it requires separate identities, structured logs, and traceable decision records so investigations can distinguish human intent from autonomous execution.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.