Give the agent a badge.
Unlocking the machine for Claude was already a firing offense when the visitor was a person.
Firms are in a hurry to put coding agents on live work. In the hurry they have started doing something they would not tolerate from a vendor. They sit the thing down at a developer’s machine, with that developer’s credentials, and let it read whatever the disk and the browser session can see. Client files. Strategy decks. API keys in .env. The chat history from last week’s incident. If you hired a consultant to rewrite a component and did this, someone in InfoSec would walk you out. With Claude Code it is Tuesday.
The first versions of these tools were locked down because people were afraid of two ordinary things: deleted files and a confidential document leaving the building. Then tool calling got good enough to trust, the defaults flipped from deny to allow, and the pitch became “look what it can finish if you just get out of the way.” The new problem set followed on schedule. How do we keep the agent out of the password store. How do we build a local information barrier. How do we pretend the workstation is still the workstation.
Industry’s answer is more product. Sandboxes. Credential proxies. Invocation-scoped micro-runtimes. nono.sh. Docker. 1Password. Fine tools, some of them. They are being sold as a way to keep using a workflow that already violates the handbook. That is a waiver with a CLI, not a control.
You already have the control. It is the third-party access policy, the least-privilege rule, the client confidentiality clause, the ban on shared logins, the requirement that a vendor get a badge and a supervised account instead of the keys to yours. None of that was written for language models. It was written because outsiders have been touching the books for decades. An agent that can read the repo, open a browser, and call an API is an outsider. Treat it like one.
Anthropomorphize it. Give it an actual identity, one existing policy can see, and treat it as you would a person. Its own IdP account. Its own GitHub user with no approval rights. Its own mailbox, if it needs one, on the internal system, restricted the way a contractor’s is. If it needs client data, it requests it, and what it gets is scoped, logged, and preferably synthetic: the same fake quarter-end file you would send the team in Vilnius. If it needs to talk to people, it uses the approved chat, not whatever consumer product the engineer already had open. If that chat is too dumb for the work, that is a separate procurement problem. It is not a reason to feed the matter to an unnamed model under a personal login.
You will hear that this is too slow, that the whole point of the agent is that it already has the context. That context is the problem. People have started calling it the blob: everything the model has been handed or has gone and fetched. Strategy, passwords, ticket threads, a customer’s numbers. You cannot inventory it after the fact any more than you can inventory what a consultant remembers from the data room. You never tried. You limited the data room.
Do not let that fact become an argument for doing nothing, or for doing only the work that never leaves the building. We have lived with residual knowledge for as long as we have hired people. Bob in sales leaves. The pipeline in his head leaves with him. We make him sign paper. Sometimes we enforce it. Often we just live with it. The firm does not shut the sales desk because a departing employee cannot be vacuumed. An agent is not different in kind. Some of what it sees will stick somewhere you do not control. That is a reason to be stingy about what goes in, and honest about the contract on the other side. It is not a reason to declare the whole category unusable, and it is not a reason to pretend a sandbox made the copy disappear.
Private tenant, “we don’t train on your data,” on-prem wrapper — none of that “undos” disclosure, and none of it needs to. The control is what you put in front of it before the session, who is on the hook for the grant, and the same blunt instruments you already use when Bob walks out: access that ends, paper that means something, and a business that accepts leftover risk instead of performing panic.
The named grant is why you do this even if the agent is competent. Right now a leak or a bad push or a client file in the wrong context window lands on whichever employee had the folder open. They were doing the job they were told to do, with no grant and no record. Badge the agent and the grant is a decision. Someone approved agent-q3-reporting for this repo, this bucket, this ticket queue. Supervision sits on a person, the way it does for every other outsider you have ever let near production. When it blows up you will not be holding a chat log and a shrug.
Yes, that means an onboarding path for a non-human worker: provision, mandate, expiry, a named supervisor. That is actual new work. Building another envelope around a shared laptop so the old violation can continue is not.