Topic starter
22/06/2026 10:15 am
TL;DR: C1.ai says Claude activity data from Claude Enterprise and the Claude Platform can now flow into the same governance layer as identity records, giving teams access, approvals, activity, and audit evidence in one place as AI usage shifts from evaluation to operational scale. Governance for conversational systems now depends on linking usage to identity, not just granting access.
Editorial analysis by NHI Mgmt Group, based on content published by C1.ai: “C1 Integrates with Claude's Compliance API”.
Key questions
Q: How should teams govern AI-agent access during an identity platform move?
A: Treat AI agents as governed identities with named owners, explicit permission scope, and lifecycle checks before they are used in discovery, testing, or rollout.
Q: When should organisations revoke AI project access?
A: Organisations should revoke AI project access when a contractor leaves, a pilot ends, a role changes, or an identity is no longer needed to operate the workflow.
Q: Why do user access reviews miss the real risk from AI agents?
A: They only test the user’s direct entitlements, not the broader actions the user can trigger through an agent.
Practitioner guidance
- Align AI access reviews to actual usage Separate active Claude users and agents from dormant ones, then certify only the access that still maps to a current business purpose.
- Tie AI activity back to the owning identity Require every Claude Platform API key and admin action to resolve to an accountable identity, role, and approval trail.
- Fold AI offboarding into the same lifecycle workflow Remove Claude seats, API access, and admin permissions as part of standard leaver and project-end handling, not as a separate cleanup step.
Bottom line: Claude governance is changing because identity data alone no longer explains AI platform use, and activity logs now matter as much as access state.
What's in the full announcement
C1.ai's full post covers the operational detail this post intentionally leaves for the source:
- How the Claude Compliance API data lands alongside identity records in C1 settings
- The exact workflow for surfacing active versus inactive Claude users and agents during reviews
- How unusual Claude Platform API key activity is tied back to the owning identity and role
- The lifecycle handling used to remove Claude seats, API access, and admin permissions when purpose ends
👉 Read C1.ai's analysis of Claude activity logs in identity governance workflows →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 11:03 am
AI governance fails when usage evidence lives outside the identity record: C1.ai's core point is that Claude activity cannot be governed safely as a separate telemetry problem. Identity records answer who was entitled, but they do not explain what was done with that entitlement. The implication is that identity governance for AI platforms now has to absorb activity evidence as a first-class control input.
A question worth separating out:
Q: Why do AI governance workflows need both identity records and activity logs?
A: Because permission alone does not prove accountable use. Identity records tell you who was authorised, while activity logs tell you what happened after access was granted. Bringing both together closes the gap between entitlement and evidence, which is where AI governance failures often start.
👉 Read our full editorial: Claude compliance data now sits inside identity governance workflows