Access Zero Logo 1

Exploring non-human identity across workloads, AI agents, and beyond.

Access Zero
Agentic AI Checklist
Agentic AI Identity Report
Credentialitis

Overview

Cinical breakdown

Linked Conditions

Diagnostic quiz

NHI Maturity Quiz
Workload IAM Handbook
Secure Claude Access
Secure Claude Access

5 Claude Workflows
Security Teams Should Review

How identity and access requirements change as Claude moves from retrieval to communication, execution, autonomous remediation, and long-running transactions.

Enterprise Knowledge Retrieval

Claude searches and synthesizes information from approved enterprise and third-party sources without changing external state.

Representative Access Path

Enterprise Knowledge Retrieval access path: an employee asks Claude, a permissions filter enforces the employee's entitlements, approved sources (SharePoint, knowledge bases, research repos, licensed data) are allowed and blocked sources (overshared files, restricted data, out of scope) are denied.
Enterprise Knowledge Retrieval access path: an employee asks Claude, a permissions filter enforces the employee's entitlements, approved sources (SharePoint, knowledge bases, research repos, licensed data) are allowed and blocked sources (overshared files, restricted data, out of scope) are denied.

Typical Use

  • Answer an internal policy question
  • Summarize project or research documents
  • Compare information across approved sources

Access Profile

Moderate
Autonomy
1/4
Sensitivity
3/4
System Boundaries
2/4
Consequence
2/4

Why this Profile

This is the control case for the series. Traditional delegated access still works reasonably well when the agent is primarily retrieving information, source permissions remain authoritative, and Claude cannot silently expand its authority. The important security problem is authorization amplification through discovery and aggregation, rather than execution.

What Can Go Wrong?

  • AI dramatically reduces the effort required to find and combine information.
  • Several individually permitted sources can reveal something much more sensitive when aggregated.
  • Overshared repositories can become easier to discover, and indexed or cached information may remain available after source permissions change.
  • Retrieved documents can contain prompt injection or misleading instructions designed to influence later reasoning or tool use.

What Controls Should Apply?

  • Preserve source-system authorization at retrieval time.
  • Restrict retrieval by tenant, repository, site, dataset, or classification.
  • Keep the workflow read-only unless another use case explicitly requires write access.
  • Treat retrieved content as untrusted input.
  • Enforce sensitivity labels, DLP rules, and contractual usage restrictions.
  • Prevent cached or indexed content from outliving revoked source permissions.
  • Preserve source attribution.
  • Log the initiating user, agent, source, resource, and purpose of access.

Email & Calendar Assistance

Claude reads communication context and may draft, send, schedule, modify, or cancel items on a user's behalf.

Representative Access Path

Email & Calendar Assistance access path: an employee asks Claude, which reaches mail, calendar and contacts. Read and draft actions are low risk; send and change actions are high risk. Both pass an action gate with a policy check and user approval if required.
Email & Calendar Assistance access path: an employee asks Claude, which reaches mail, calendar and contacts. Read and draft actions are low risk; send and change actions are high risk. Both pass an action gate with a policy check and user approval if required.

Typical Use

  • Summarize an email thread
  • Draft or send a reply
  • Schedule or modify a meeting

Access Profile

High
Autonomy
2/4
Sensitivity
3/4
System Boundaries
2/4
Consequence
3/4

Why this Profile

The security hinge is the transition from understanding information to changing something outside the model. The same context that helps Claude draft an intelligent response can also become the input that persuades it to take an unintended action.

What Can Go Wrong?

  • Email is both data and an instruction channel.
  • A malicious message can attempt to persuade Claude to disclose information, forward content, contact an external recipient, modify a meeting, or invoke another connected tool.
  • Overbroad write permissions convert a mistaken model decision into an action performed with the user's apparent authority.

What Controls Should Apply?

  • Separate read, draft, send, modify, and delete capabilities.
  • Require confirmation or policy approval for consequential actions.
  • Validate recipients, attendees, and targets immediately before execution.
  • Apply additional restrictions to external communication where appropriate.
  • Prevent instructions inside email from granting additional authority.
  • Use short-lived, revocable delegated credentials.
  • Log both the initiating human and the resulting agent action.

Software Development & CI/CD

Claude can move from reading code into editing files, executing commands, invoking build systems, publishing packages, and reaching cloud infrastructure.

Representative Access Path

Software Development & CI/CD access path: a developer works through Claude using short-lived, least-privilege scoped credentials to reach approved resources (Git repos, CI/CD, artifact registry, cloud accounts). Ambient credentials such as long-lived keys, broad cloud keys and personal access tokens should be avoided.
Software Development & CI/CD access path: a developer works through Claude using short-lived, least-privilege scoped credentials to reach approved resources (Git repos, CI/CD, artifact registry, cloud accounts). Ambient credentials such as long-lived keys, broad cloud keys and personal access tokens should be avoided.

Typical Use

  • Explain or modify a codebase
  • Propose and test a patch
  • Troubleshoot a build or deployment problem

Access Profile

Critical
Autonomy
2/4
Sensitivity
3/4
System Boundaries
3/4
Consequence
4/4

Why this Profile

This is where AI access becomes execution authority. The model itself does not define the blast radius. The terminal, credentials, repositories, build systems, and infrastructure placed behind the model do.

What Can Go Wrong?

  • Once Claude can execute commands, untrusted information can become execution.
  • The agent may modify or delete files, install malicious dependencies, expose source code, misuse developer credentials, push unwanted commits, publish packages, or reach production infrastructure.
  • Code, issues, documentation, package metadata, dependency output, and tool responses can all contain hostile instructions.

What Controls Should Apply?

  • Separate read, write, build, publish, deploy, and cloud privileges.
  • Use ephemeral credentials rather than inherited developer secrets.
  • Scope authorization by repository, branch, environment, resource, and task.
  • Sandbox execution where feasible.
  • Constrain dangerous tools and network reach.
  • Require review for merges, releases, package publication, and production changes.
  • Keep development and production identities separate.
  • Scan for secret and dependency risk.
  • Record commands, tool calls, credentials used, and resulting changes.

Incident Response

Claude begins from a security event, investigates across systems, chooses its own next steps, and may take containment or remediation action without human approval at every stage.

Representative Access Path

Incident Response access path: a security alert triggers Claude, which investigates with broad read access across SIEM, cloud, endpoint and identity, then passes a policy and approval gate (human approval for high-impact actions) before remediating, such as disabling an account, isolating a host or blocking an IP.
Incident Response access path: a security alert triggers Claude, which investigates with broad read access across SIEM, cloud, endpoint and identity, then passes a policy and approval gate (human approval for high-impact actions) before remediating, such as disabling an account, isolating a host or blocking an IP.

Typical Use

  • Investigate suspicious activity
  • Correlate evidence across security systems
  • Contain or remediate a confirmed incident

Access Profile

Critical
Autonomy
4/4
Sensitivity
3/4
System Boundaries
4/4
Consequence
4/4

Why this Profile

Autonomy changes the access model. Claude is no longer simply performing one explicitly requested action using a person's delegated authority. It is deciding what to do next and crossing systems to do it. That makes the agent itself a meaningful security principal.

What Can Go Wrong?

  • A broadly privileged SOC identity gives the agent administrator-level reach.
  • Investigation privileges silently include remediation authority.
  • A mistaken inference disables a legitimate account or production workload.
  • Malicious or corrupted telemetry redirects the investigation.
  • The agent moves across systems without new policy decisions.
  • Elevated credentials remain usable after the incident ends.
  • Individual systems record different actors, making the authority chain impossible to reconstruct.

What Controls Should Apply?

  • Give the autonomous agent its own identity.
  • Scope authority to the incident, affected resources, and time window.
  • Separate investigation from remediation.
  • Acquire short-lived credentials only when needed.
  • Evaluate policy before consequential tool calls.
  • Require approval for selected actions based on risk and blast radius.
  • Restrict which accounts, workloads, environments, and resources may be changed.
  • Automatically expire elevated authority.
  • Preserve the complete sequence from triggering event through final action.

Autonomous Procurement Workflow

Claude carries a business process across systems, human approvals, and time, eventually reaching authority to commit company money.

Representative Access Path

Autonomous Procurement Workflow access path: employee request, Claude, vendor research, create requisition, pause to await approval, approval received, place order, finance and purchasing. The workflow resumes in the same context with no standing purchasing credentials.
Autonomous Procurement Workflow access path: employee request, Claude, vendor research, create requisition, pause to await approval, approval received, place order, finance and purchasing. The workflow resumes in the same context with no standing purchasing credentials.

Typical Use

  • Research and compare approved vendors
  • Prepare and route a purchase request
  • Complete an approved purchase workflow

Access Profile

Critical
Autonomy
4/4
Sensitivity
3/4
System Boundaries
3/4
Consequence
4/4

Why this Profile

This workflow introduces a distinct authorization problem: authority must remain valid across a long-running business process without turning into standing privilege. The process may pause for hours or days, cross multiple approvers.

What Can Go Wrong?

  • Approval for one amount is reused for a larger purchase.
  • Approval for one vendor or item is applied to another.
  • The agent exceeds an employee's purchasing authority or organizational spending limits.
  • A paused workflow resumes after price, vendor, policy, or approval conditions have changed.
  • Standing procurement credentials remain available between workflow steps.
  • Vendor-provided content manipulates the agent's recommendation or action.
  • A generic service identity obscures who requested and approved the transaction.

What Controls Should Apply?

  • Bind authority to a specific requisition or business purpose.
  • Preserve the employee, agent, approvers, and resulting transaction as one authority chain.
  • Apply explicit limits by amount, vendor, category, geography, cost center, or transaction.
  • Treat approval as bounded authorization rather than a generic permission to proceed.
  • Separate research, requisition, approval, and purchase execution.
  • Reevaluate authorization after pauses and when material transaction details change.
  • Acquire short-lived credentials for each required action.
  • Prevent approval from being replayed or reused for another transaction.
  • Record which decisions were autonomous and which were explicitly approved.
Powered by
Aembit logo white
Quick access
Sign Up for Updates
Identity-obsessed? Want to keep up with the Identity Universe?
Sign up to receive the latest news from Aembit!
Linkedin X-twitter Youtube

Privacy Policy

Terms of Service

Copyright © 2026. All rights reserved.