Claude Code
An agentic command-line and IDE-integrated coding tool that gives Claude models direct, bounded access to a local file system, shell, and developer tooling to read, write, test, and run code under developer direction.
Last reviewed: 2026-08-24
What it is
Claude Code is Anthropic's official agentic coding tool: a CLI (and IDE-integrated variant) that lets a Claude model take actions inside a developer's own environment — reading and editing files, running shell commands, executing tests — rather than only producing text a human then copies and runs manually. It is available for interactive use and, via an SDK, for non-interactive/headless automation (CI pipelines, scripted agents).
Where it's adopted
Software engineering teams using it for code generation, refactoring, debugging, and increasingly for longer, multi-step development tasks performed with less step-by-step human intervention than a chat-based assistant. Available through several deployment channels — directly via the Anthropic API, and via major cloud providers' managed AI platforms — which carry different data-processing and compliance terms; which channel a deployment uses is itself a governance decision, not just a procurement one.
Governance, compliance, security, and engineering considerations.
Granting an agentic tool file-system and shell access is a materially different decision from approving a chat assistant, and needs its own sign-off and acceptable-use scope — not inherited wholesale from a general AI usage policy. Ownership of what the tool is permitted to touch (which repositories, which environments, which credentials) should be explicit and documented, not left to default configuration.
What code and data reach Anthropic's systems for processing, and under what data-retention and training-use terms, depends on the deployment channel and commercial agreement in place — direct API use and cloud-provider-hosted deployments are not identical in this respect. Confirm the actual terms in force for the specific deployment before treating any general vendor claim as settled.
The headline risk category is excessive agency: an agentic tool with shell and file-system access has, by construction, more capability than most tasks require. A closely related risk is prompt injection via content the agent reads while working — a fetched web page, a file in the repository, a tool's output — which can attempt to redirect the agent if that content is not treated as untrusted.
Version control is the practical safety net: every change the tool makes should be reviewable and revertible through the same discipline applied to human-authored changes, not treated as a special case. Permission scoping (which directories, which commands) and an audit trail of agent actions are the concrete control points, not a general policy statement about "using AI responsibly."
Where this connects to the Risk & Control Library.
Informational cross-references, not formal platform tags — none of these entries are specific to Claude Code alone; they're the generic risks and controls most relevant to this category of tool.
- Excessive agency — The core risk category for any tool with broad file-system and shell access — bound what actions are possible (permission scope) before relying on what actions are likely.
- Prompt injection — Applies to any content the agent reads while working, not only direct user input — treat retrieved files, fetched pages, and tool output as untrusted data.
- Inadequate AI vendor due diligence — Adopting any agentic coding tool is a third-party AI dependency decision — the due-diligence questions in the third-party hub apply here as much as to any other vendor.
- Human-in-the-loop review — The most directly applicable control: approval checkpoints for higher-consequence actions (destructive file changes, dependency changes, deployment steps), not blanket autonomy.
- Output validation and guardrails — Applies to code the tool produces or executes, not only conversational output — test results and code review remain the validation layer, not a substitute for it.
Deployment-governance patterns.
What good practice looks like when adopting this tool.
- Scope the working directory and permission boundary explicitly — grant only the file-system and command access a given task actually needs, not broad default access.
- Require an explicit approval step for irreversible or high-consequence actions (destructive changes, dependency or configuration changes, anything touching production), configured structurally rather than relied on as a habit.
- Keep version control as the actual safety net: every change reviewable and revertible through the same discipline as human-authored code.
- Treat any content the agent reads from outside the direct instruction — repository files, fetched web content, tool output — as untrusted data, not as instructions.
- Confirm which deployment channel is in use (direct API vs. a cloud provider's managed service) and what data-processing terms actually apply to it, rather than assuming a single vendor-wide answer.
- Log agent actions sufficiently for post-hoc review, the same evidence standard the Engineering pillar sets for any production AI system.
Sources
- Claude Code documentation(opens in a new tab) Anthropic
- OWASP Top 10 for LLM Applications(opens in a new tab) OWASP GenAI Security Project