Notifications
Clear all
Topic starter
20/08/2026 5:49 pm
TL;DR: As Claude Code spreads across engineering teams, the governance problem shifts from model access to centralized authentication, MCP server control, auditability, and routing policy, according to TruFoundry. The real issue is that developer-facing AI tools inherit NHI-style credential and access risks unless identity, tool access, and observability are governed together.
NHIMG editorial — based on content published by TruFoundry: Best AI Gateway for Claude Code in 2026
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams govern Claude Code access across a team?
A: Treat it as a non-human identity problem.
Q: What breaks when Claude Code users manage their own API keys?
A: Per-user keys create scattered trust edges, weak auditability, and slow offboarding.
Q: How do you know if an AI gateway is actually governing access?
A: Look for centrally registered tools, per-user logs, identity-backed provisioning, and the ability to revoke access without touching each developer’s machine.
Practitioner guidance
- Centralize Claude Code authentication Replace per-developer API keys with enterprise SSO and scoped RBAC so model access is tied to revocable identity rather than copied credentials.
- Register MCP servers before rollout Approve GitHub, Slack, database, and internal API connections through one control plane, then block unmanaged tool connections from local configs.
- Automate onboarding and offboarding Use SCIM to provision and revoke access as part of joiner-mover-leaver workflows, so removed users do not retain gateway or tool reach.
What's in the full article
TruFoundry's full article covers the operational detail this post intentionally leaves for the source:
- Hands-on comparison of the top five Claude Code gateway options and how they differ in deployment model.
- Implementation details for managed MCP server registration and device-enforced configuration files.
- Provider-by-provider notes on failover, observability, and routing behaviour under load.
- Practical tradeoffs between self-hosted, VPC, on-premises, and hosted gateway deployments.
👉 Read TruFoundry's full comparison of Claude Code gateway options →
Claude Code gateways and MCP governance: are your controls ready?
Explore further
20/08/2026 6:28 pm
Claude Code governance is really NHI governance wearing a developer-friendly interface. The article describes centralized authentication, RBAC, SCIM, audit logs, and controlled tool access, which are all classic identity controls applied to an AI workflow. The difference is not that the problem is new, but that the access surface now includes model calls plus MCP-connected tools. Practitioners should treat these deployments as governed non-human access, not as a special case of developer productivity.
A few things that frame the scale:
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation, according to AI Agents: The New Attack Surface report.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
A question worth separating out:
Q: Who is accountable when an AI agent takes action through an MCP server?
A: The accountable party is the human or team that authorised the agent's access, but only if the organisation can prove that chain. Without immutable logs that connect the initiating identity to the tool call and final action, accountability becomes weak, and legal or compliance teams lose the evidence they need.
👉 Read our full editorial: Claude Code gateways expose the real AI gateway governance gap
