Large enterprises need more than "looks fine". They need auditable guardrails, sandboxing, secret protection and a clean story for their CISO. Below is the exact security posture we deploy for regulated B2B clients.
Updated: April 24, 2026
The agent runs as an OS user with access only to the repo. No database creds in `.env`; instead, short-lived tokens issued by the MCP server. No AWS or GCP creds on the box; use IAM roles on ephemeral CI runners.
Deny-list on paths (`.env*`, `**/secrets/**`, `infra/**/production/**`). Require explicit confirmation for Bash commands that contain `rm`, `curl` to untrusted domains, or database mutations. Block outbound network except on an allowlist.
Every session transcript is archived to an S3 bucket with 7-year retention, keyed by engineer and client. PR metadata links back to the transcript. A CISO can reconstruct any change end-to-end.
For EU customers we deploy Opus 4.7 via Amazon Bedrock in eu-central-1 or Google Vertex AI in europe-west4. For US federal we use Bedrock GovCloud. The Claude Code CLI is configured to talk to the regional endpoint, not the public Anthropic API.
Only via MCP servers that you explicitly configure. By default the agent has no production credentials. We recommend keeping that default.