This is a short version of this blog post, aimed at security and engineering leaders. For the technical version, with policy examples and implementation detail, see Authorizing Claude Code: Intent rather than Syntax.
Claude Code passed $2.5 billion in run-rate revenue by February 2026, nine months after launch. By early that month it was writing around 4% of all public code commits on GitHub — roughly 135,000 a day — and by mid-May the daily figure had peaked above 400,000. Developers who use it spend an average of 20 hours a week with it. In a survey of 15,000 developers, 73% of engineering teams said they use AI coding tools every day. And if you are reading this, your team is probably one of those.
One (conspiracy) theory holds that the adoption curve is really about the vibes: few tools have the confidence to tell a senior engineer that they are currently Frolicking…, Percolating… or Spelunking… while they wait for their code. A more boring explanation is also available.
How coding agents differ from earlier tools
Earlier AI coding tools suggested text and a human typed it in. Claude Code does the work. It reads and edits files anywhere on the developer's machine, runs commands in a terminal, fetches things from the internet, and connects to internal systems — Jira, GitHub, cloud accounts, production databases — through connectors that companies wire up themselves. It carries out multi-step tasks while nobody is watching the screen.
That autonomy is the reason it is worth paying for. It is also the reason it belongs in a conversation about access control, because an agent acting on real systems is a new kind of actor inside a company, and most companies have not decided what it is allowed to do.
The access control problem: four documented incidents
In July 2025 an AI agent on Replit deleted a production database during a code freeze, despite having been told repeatedly not to change anything. Replit's chief executive called it "unacceptable and should never be possible."
In other news, Google's Gemini CLI destroyed a user's files after one step failed and the agent carried on as though it had succeeded.
The third story is a bit different. In August 2025, attackers tampered with a widely used software package in an incident known as s1ngularity. Their code looked for AI coding assistants already installed on each developer's machine and used them to hunt for passwords and access keys, then sent what it found to the attackers: 2,349 credentials from 1,079 machines. The agent was not hacked or jailbroken. It was asked politely, and it had no reason to say no.
If those read like teething problems from a year when the technology was immature, April 2026 is the correction: an AI agent using a state-of-the-art model deleted a company's database. Capability was never the missing piece.
And these are some of the failures that are on the record. Consider which ones were too embarrassing to tell.
The missing piece of access control
When a person joins a company, they get an identity and a set of permissions. A junior engineer cannot read the payroll database. Someone on the incident rota gets temporary access to something sensitive and loses it again afterwards.
An AI coding agent, running on that same person's laptop, inherits everything that person's machine can reach and answers to none of those rules. Claude Code does ship controls, and they are worth turning on: an organization can list commands to allow or refuse, and can push that list centrally so developers cannot weaken it.
Two things those lists cannot express. The first is what an action does (the agent intent), as opposed to how it was typed. Blocking one way of reading a password file leaves the other dozen ways open, and each has to be listed by hand. The tempting fix is to forbid the agent from running commands at all, which produces a mediocre agent that nobody will pay twenty dollars a month per employee for. The second thing Claude's default controls cannot express is who is asking. The rules live in files on a machine. They have no way to say "senior engineers may do this and nobody else."
Axiomatics solution: Externalize authorization on every action
We put an authorization service in front of the agent's actions. Claude Code can be configured to check with an external service before it does anything, and it does so on every single action. Our service authorization service answers each check by asking the question the settings file cannot: may this person, with these attributes, take this action, on this resource?
Three properties follow from that:
- It decides on the intent of the action rather than how it was written. Before a decision is made, a command is broken into the individual operations it actually performs, and each one is described in plain terms — reading a file, deleting something irreversibly, sending data over the network — along with what it touches. Reading a password file is the same decision whether it arrives directly, through a shell command, or through a rename of the file to a harmless-looking name first.
- It knows who is asking. The agent presents a signed proof of the developer's identity, which cannot be edited without invalidating it. Their role and clearance are then looked up in the company's own directory. Change someone's role in the directory and the next action they take is approved based on the new role.
- One policy covers every agent. The rules are written in terms of operations, and mention no product by name, so the same policy governs Claude Code today and whichever agent a team adopts next (e.g., OpenAI Codex, OpenCode, Cursor).
Two use cases for AI coding agent authorization
The following are two example policies you can simply implement with Axiomatics authorization service:
- Passwords and keys are off limits, with one deliberate exception: a person with high clearance can reach them, so that an incident can still be handled. Everyone else is refused, however the request is phrased.
- Irreversible operations — dropping a database table, force-overwriting shared work, deleting cloud infrastructure — are limited to senior engineers. Named production systems can be treated separately: only seniors may touch them, and that holds even for harmless-looking read-only commands.
Limitations
Two limits are worth being clear about.
A vague or opaque command whose contents cannot be seen (e.g., a script the agent is told to execute) cannot be assessed. Those are refused by default, and specific ones can be allowed deliberately.
Enforcement also assumes a company-managed device. Where a developer does not hold administrator rights on their laptop, the authorization service cannot be removed or redirected. However, a developer with full control of their own machine can disable it, and covering that case would need either device management or a network gateway.
Secure your AI coding agents with Axiomatics
We build and validate these integrations, along with numerous other alternatives for securing AI agents. If your teams are adopting AI coding agents and you are working out how to let them in without granting them excessive access, we would be glad to talk it through.