# Anthropic Releases Compliance API to Track Claude Code Agent Activity, Exposing Identity Governance Gaps
Anthropic has launched new Compliance API endpoints designed to give security teams visibility into Claude Code's operational activity. The move addresses growing concerns about AI agent activity logging, but reveals a deeper challenge: observability without proper identity governance provides an incomplete security posture.
Claude Code executes code on developer machines with significant capabilities. It reads files, executes shell commands, invokes Model Context Protocol (MCP) tools, and acts through credentials available in the developer's local environment. This flexibility powers its usefulness but creates risk. An agent acting under compromised credentials or with overpermissioned access can cause substantial damage.
The new Compliance API endpoints log Claude Code's actions. Security teams can now track file access, command execution, and tool invocations with greater clarity than before. This addresses a real gap. Prior to this release, organizations deploying Claude Code had limited visibility into what the agent actually did on systems where it ran.
The Compliance API enables teams to retain activity logs for audit purposes and compliance reporting. This matters for regulated industries. Financial services firms, healthcare organizations, and government contractors face requirements to demonstrate that system access is logged and monitored. Without these endpoints, Claude Code deployments created blind spots in audit trails.
However, Anthropic's own framing of the release highlights the fundamental problem. Activity logs alone cannot verify whether an agent's access is legitimate. This is the identity governance challenge.
Logging proves an action happened. It does not prove the action should have happened. If Claude Code reads a sensitive file, the log records the read. The log does not answer whether Claude Code should have accessed that file. That determination requires identity governance controls.
Identity governance answers different questions than logging does. It defines who Claude Code is, what roles it holds, what permissions attach to those roles, and whether those permissions remain appropriate. It enforces principle of least privilege. It revokes permissions when they expire or when risk changes.
Without identity governance, compliance teams operate in reactive mode. They review logs after incidents, looking for unauthorized activity. With identity governance, security teams operate in preventive mode. They define access policies upfront and deny inappropriate requests before they happen.
Anthropic's release moves the needle on visibility. Organizations can now see Claude Code's activity in their Compliance API logs. This enables better auditing and faster incident response if something goes wrong.
The next phase requires deeper integration with identity and access management systems. Claude Code needs to respect organization-wide policies about file access, credential scope, and tool availability. It needs to integrate with role-based access control (RBAC) or attribute-based access control (ABAC) frameworks already deployed in enterprises.
Organizations deploying Claude Code should view the Compliance API as necessary but insufficient. Implement logging. Then layer on identity governance. Define what Claude Code should be able to access. Use credential scoping to limit what credentials Claude Code can use. Implement approval workflows for sensitive operations. Review and revoke permissions regularly.
The release signals Anthropic's attention to enterprise security concerns. The larger trend toward AI agent deployment will accelerate demands for both visibility and governance. Teams that master both logging and identity controls will deploy agents more safely.