Topic starter
22/06/2026 10:16 am
TL;DR: C1.ai says its integration with Anthropic's Claude Compliance API extends identity governance into Claude Enterprise and the Claude Platform by combining access records with activity telemetry for reviews, lifecycle workflows, and audit trails. The real gap is that seat provisioning alone cannot prove whether AI access is still justified, especially when API keys, dormant users, and agent actions outlive the original purpose.
Editorial analysis by NHI Mgmt Group, based on content published by C1.ai: “C1 Launches Integration with Claude's Compliance API to Govern AI Identity and Activity in a Single Platform”.
Key questions
Q: What breaks when Claude access is reviewed without activity telemetry?
A: Teams end up certifying accounts that are still entitled but no longer justified by use.
Q: What does AI change in identity and access governance reviews?
A: AI changes the speed and volume of review, not the accountability model.
Q: How do security teams spot orphaned Claude access before it becomes an audit finding?
A: Look for accounts, keys, or admin grants with no recent activity but no formal offboarding event.
Practitioner guidance
- Tie access reviews to actual usage Require review workflows to include recent activity, not only assigned roles or group membership, so dormant Claude access is visible before recertification closes.
- Reconcile API keys to a named owner Map every Claude Platform API key back to the person or team responsible for it, then flag keys that show activity but lack an accountable owner.
- Flag dormant seats and orphaned permissions Treat thirty-day inactivity as a governance signal, not a helpdesk metric, and remove seats or admin rights that no longer match the current business purpose.
Bottom line: Claude governance is exposing a familiar failure mode in a new setting: access approval without usage evidence.
What's in the full announcement
C1.ai's full post covers the operational detail this post intentionally leaves for the source:
- How the Claude Compliance API maps activity events into identity records
- The exact lifecycle workflow changes for dormant seats and unused admin permissions
- What audit evidence becomes available when request, approval, and activity are joined
- How existing C1 customers can enable the connector in settings
👉 Read C1.ai's analysis of Claude activity governance and AI identity control →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 11:04 am
Claude governance exposes an activity gap, not just an access gap: identity programmes built only around provisioning and recertification cannot explain what a user, key, or agent is doing after access is granted. That is a structural weakness when AI platforms generate their own operational history through prompts, calls, and automated actions. The practitioner conclusion is clear: activity must become part of the governed identity record.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations govern human, NHI, and AI agent access in one programme?
A: Use one identity governance model with different control treatments by actor type. Human access still needs joiner-mover-leaver discipline and certification. NHIs need ownership, rotation, and revocation. AI agents need runtime scope control, explicit action boundaries, and visibility into the identities they use to reach tools and data.
👉 Read our full editorial: Claude activity governance exposes the gap in AI identity control