"Riddle me this: I live on your host as an agent, but I was here long before any LLM," writes Dan Abramov, Security Researcher. That line captures the core tension introduced by Claude Code: powerful model-driven decision‑making in the cloud, executed through a harness that runs with the privileges, files, and network position of the endpoint it inhabits.
Anthropic's Compliance API local session transcripts (introduced Aug 11, 2026)
On August 11, 2026, Anthropic expanded its Compliance API to include new endpoints for local sessions that surface what reaches Anthropic's models. The API records session activity in three block types — text, tool_use, and tool_result — and logs user prompts, bash commands, reads and writes, and MCP commands whenever the harness sends context to the model. Because the model holds no server‑side state and the harness resends full context on every turn, anything the model receives is captured in those transcripts. That behavior gives security teams unprecedented visibility into agent actions that interact with Anthropic's models — but only when the session actually contacts those models.
Managed settings in Claude Code: a policy baseline that trades flexibility for control
Claude Code endpoints install a managed‑settings record — a JSON file on macOS and Linux or registry records on Windows — that enforces organizational rules. On an enterprise plan, policies can be applied through Anthropic's GUI; absent an enterprise plan, an MDM can write the managed‑settings record across endpoints. Available rules include allow/deny lists for specific MCP servers, regexes over bash commands, and the ability to disable skills from running commands. Those controls establish a baseline, but they are static, remove maneuvering room from developers, and do not capture context or intent.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleOpenTelemetry, hooks, and the hard limits of model‑side logging
Not every action on the endpoint reaches Anthropic's models, so the Compliance API alone does not provide full coverage. Hooks — local checks that run between the model's decision and tool execution — can block prompts or tools before they are sent to the model; those actions never appear in Compliance API transcripts. OpenTelemetry (OTel) fills some of that gap: common harnesses include OTel support and OTel records traces, metrics, event logs, tool‑permission decisions, and the actor who made them. Permissions changes moved into bypassPermissions / auto mode are logged in OTel but not in the Compliance API. Operationally, OTel produces atomic logs; transcripts are dense JSON blobs that must be parsed to extract the same atomic events. Importantly, the Compliance API covers only interactions with Anthropic's models — sessions running on Bedrock, Foundry, or other models receive no Coverage at all.
Endpoint evidence: files, credentials, skills, and standing access
Because Claude Code executes locally, endpoint telemetry reveals processes, files, configurations, and standing credentials that cloud services cannot see. Token Security reports that local agents represent 68.6% of the AI agents it finds in customer environments, and that Token finds an average of more than 10 configuration files per local agent scattered across a host. MCP server commands surface as tool_use entries named mcp__<server>__<command>, and roughly 35.1% of discovered MCP servers are community‑built or of unknown origin — each representing a standing credential on the endpoint. Skills and plugins live on disk; when a skill runs, the harness often sends the SKILL.md or issues a Read that reveals both the skill name and its path. Plugins bundle scripts and .md files and are recoverable through path conventions when their files are read into context. Endpoint collection — harvesting config files, skill and plugin .mds, and correlating EDR logs — remains essential because neither the Compliance API nor OTel can see files that never enter a session.
What this means for technologists, security teams, and procurement
- Technologists and security teams: Combine the three layers — managed settings, Compliance API transcripts, and endpoint collection (including OTel and EDR) — then parse transcripts to extract atomic actions. Correlate skills and plugins against internal repositories to increase confidence in provenance before treating an artifact as legitimate.
- Procurement and IT administrators: If you use an enterprise plan, apply managed settings via the GUI; otherwise, deploy managed‑settings records with MDM. Treat local session transcripts as a sensitive data source (they can contain PII, secrets, and customer data) and build retention, labeling, and deletion policies — Claude Code stores session history locally for 30 days by default.
- Developers and end users: Avoid writing raw secrets into sessions; label projects and sessions that contain sensitive customer data and delete them on a schedule. Be aware that sessions, skills, and plugins on disk can be read by anyone who gains endpoint access.
Anthropic's Compliance API local session endpoints are a meaningful advance: they give security teams "their clearest view yet" into what a cloud model was asked and what tools it used. But the records themselves are evidence, not governance. As the source puts it, telemetry can show what happened; governance requires connecting those signals to an agent's owner, purpose, identities, credentials, permissions, and access paths. Identity, in short, is the control plane that will determine whether the new visibility turns into enforceable security.
