Topic starter
22/06/2026 10:16 am
TL;DR: C1.ai's analysis of Claude governance finds that access reviews still miss whether seats, keys, and agent actions match current purpose. IAM and IGA teams need activity evidence as well as entitlement records to retire dormant access before audit issues surface.
Editorial analysis by NHI Mgmt Group, based on content published by C1.ai: “C1 Launches Integration with Claude's Compliance API to Govern AI Identity and Activity in a Single Platform”.
Key questions
Q: What does AI change in identity and access governance reviews?
A: AI changes the speed and volume of review, not the accountability model.
Q: How do security teams spot orphaned Claude access before it becomes an audit finding?
A: Look for accounts, keys, or admin grants with no recent activity but no formal offboarding event.
Q: What breaks when Claude access is reviewed without activity telemetry?
A: Teams end up certifying accounts that are still entitled but no longer justified by use.
Practitioner guidance
- Tie access reviews to actual usage Require review workflows to include recent activity, not only assigned roles or group membership, so dormant Claude access is visible before recertification closes.
- Reconcile API keys to a named owner Map every Claude Platform API key back to the person or team responsible for it, then flag keys that show activity but lack an accountable owner.
- Flag dormant seats and orphaned permissions Treat thirty-day inactivity as a governance signal, not a helpdesk metric, and remove seats or admin rights that no longer match the current business purpose.
Bottom line: Claude governance is exposing a familiar failure mode in a new setting: access approval without usage evidence.
Glossary terms: Usage Telemetry, Dormant access, Orphaned API Access, Usage-Aware Recertification
What's in the full announcement
C1.ai's full post covers the operational detail this post intentionally leaves for the source:
- How the Claude Compliance API maps activity events into identity records
- The exact lifecycle workflow changes for dormant seats and unused admin permissions
- What audit evidence becomes available when request, approval, and activity are joined
- How existing C1 customers can enable the connector in settings
👉 Read C1.ai's analysis of Claude activity governance and AI identity control →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
22/06/2026 11:04 am
Claude governance exposes an activity gap, not just an access gap: identity programmes built only around provisioning and recertification cannot explain what a user, key, or agent is doing after access is granted. That is a structural weakness when AI platforms generate their own operational history through prompts, calls, and automated actions. The practitioner conclusion is clear: activity must become part of the governed identity record.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations govern human, NHI, and AI agent access in one programme?
A: Use one identity governance model with different control treatments by actor type. Human access still needs joiner-mover-leaver discipline and certification. NHIs need ownership, rotation, and revocation. AI agents need runtime scope control, explicit action boundaries, and visibility into the identities they use to reach tools and data.
👉 Read our full editorial: Claude activity governance exposes the gap in AI identity control