Claude Codeby Anthropic

Govern · Claude Code

Claude Code, governed on the laptop it runs on.

Q: Does Agen replace Claude Code's permission settings and hooks?

No. Engineering keeps settings.json, managed settings and hooks. Agen adds a central verdict on each action, anchored to the developer's identity, and a record that exists outside the machine. The two layers do different jobs.

Q: Does it slow Claude Code down?

No. The verdict returns in under 30ms on the device, in-line with the action. A developer notices nothing until an action crosses policy, and then only that action pauses.

Q: Can we govern Claude Code running in CI or in a cloud session?

Yes. The same policy plane governs the endpoint, the gateway and the cloud. Sessions running in GitHub Actions or in a hosted environment are tied to the identity that launched them and judged by the same rules.

Q: What about MCP servers Claude Code connects to?

Every MCP call is an action, and each one is judged. Servers can be discovered, approved once by the agent's owner, and routed through the MCP Gateway so the tokens never sit in a local config file.

Q: Is this sold to individual developers?

No. Agen is deployed by the security or platform team across the developer fleet. Individual developers keep using Claude Code as they do today.

Claude Code runs in your developers' terminals, on their own credentials, against your repos, your CI and every MCP server they connect. Agen judges each action it takes at runtime, against the developer behind it, and records the verdict. The developer keeps Claude Code.

Book a demo See the verdicts

Enforced on the endpointAgenShieldStopped on the device, before execution. The gateway's verdict, enforced where the gateway cannot see.

<30ms

per-action verdict on the device

1:1

a named developer behind every session

changes to the developer's workflow

1 day

from install to governing

How Agen governs Claude Code

AgenShield runs on the developer's machine and stops out-of-policy file reads, writes, shell commands and MCP calls before they execute. It is the gateway's verdict, enforced where the gateway cannot see.
Each action resolves to the developer's identity from your IdP. The agent acts as a governed principal tied to that person, not as an anonymous process.
Policy returns a verdict in under 30ms: allow, mask, step up, hand to a human, or deny. Only the crossing action stops. The session continues.
Every verdict is recorded with its full chain: which developer, which repo, which command, which decision. Evidence exists at action time.
Claude Code's own settings and hooks stay in place. Agen adds the central verdict and the record those files cannot produce on their own.

What Claude Code reaches

A terminal agent with the developer's full reach.

Claude Code is capable by design. These are the things it can do on a machine that has your developer's credentials on it.

Files and repos: Reads and edits any file in the working tree, and any path the developer's account can reach outside it.
Shell commands: Runs build, test, package and system commands with the developer's local privileges.
Git and CI: Commits, pushes, opens pull requests and runs inside GitHub Actions with the credentials it is given.
MCP servers: Connects to Jira, GitHub, databases, internal APIs and anything else exposed as an MCP server, each with its own stored token.
Hooks and subagents: Spawns subagents and runs hook scripts, so one prompt can fan out into many actions.
Cloud sessions: Runs unattended in Anthropic-hosted sessions with repository access, outside the laptop entirely.

Where the native controls stop

Claude Code's controls are real. They are also local.

Permission rules, managed settings and hooks do real work and engineering should keep them. They answer a different question than the one security is accountable for.

A settings file is not a control

Allow rules, deny rules and approval prompts live in settings.json on each machine. They configure one tool on one device, and nothing outside that machine sees the decision.

enforcement scopeone machine

It acts as your developer

Claude Code runs on standing credentials that already reach your repos and CI. When a change lands badly, the author field is a person's name, and nothing on the machine says who chose the action.

author fielda person's name

Every MCP server is another door

Each server widens what a single prompt can reach. The allowlist deciding which ones are permitted lives in the same local file as everything else, next to the tokens.

blast radiusgrows per server

No record anyone else can read

Hooks can log locally, if someone builds that. There is no central place to write a rule, see what was decided, or hand an auditor who asks what developers' agents did last quarter.

central audit trailnone

How Agen governs it

Same agent, same laptop. One verdict per action.

The gateway decides. Shield enforces where the gateway cannot see. AgenShield sits on the device, does not change how Claude Code is used, and stops the crossing action before it executes.

01 · Discover

Find every Claude Code install

Endpoint telemetry surfaces every machine running Claude Code, every MCP server configured on it, and every developer using it, including the ones nobody approved.

02 · Identify

Tie the session to a developer

Each session resolves to the developer's identity from your IdP. The agent becomes a governed principal with a named human accountable for it.

03 · Govern

Judge each action in-line

File writes, shell commands and MCP calls are evaluated against policy and the identity behind the agent. A verdict returns in under 30ms, before the action executes.

04 · Evidence

Record the chain

Every action and verdict is logged with the developer, repo, command and decision. Exported to your SIEM. Produced at action time, not reconstructed later.

Shield

The gateway decides. Shield enforces where the gateway cannot see.

Claude Code runs on the developer's machine, so AgenShield does the work: the gateway's verdict, enforced where the gateway cannot see. BrowserShield covers what the same developer pastes into AI tools in the browser.

On the device

AgenShield

Primary for Claude Code

Out-of-policy actions like touching production secrets or mass-deleting files are stopped before they execute. Everything else flows. Ships through your MDM.

AgenShield · Claude Code · dev-mbp-014blocked

Actionexfil · prod-secrets.env

Stoppedon device, before execution

Verdict28ms · logged

AgenShield in depth →

In the browser

BrowserShield early access

Keys and sensitive data are recognised as they are pasted into AI tools, and the paste is blocked. Employees keep their tools. Only the leak stops.

BrowserShield · chatgpt.compaste blocked

Detectedcompany API key in paste

Everything elseflows normally

Verdictlogged · same audit chain

Join the early-access program →

Same policy · same identity · same verdictShield overview How the gateway decides

Governed actions

What Claude Code asks to do, and what policy says.

Illustrative verdicts for common Claude Code actions under a typical policy. Every one of these is a rule you write once.

Typical per-action verdicts for Claude Code
Claude Code action	Verdict	Why
Read and edit files inside the working tree	allow	In scope for the developer and the task. Logged, not interrupted.
Run the test suite or a local build	allow	Normal engineering work on the developer's own machine.
Read ~/.aws/credentials or a .env with production secrets	deny	A production secret has no place in an agent's context. Blocked before the read completes.
Push directly to a protected branch	step-up	The developer confirms the action from their phone. Approved, the push continues.
Run rm -rf or a mass delete outside the repo	deny	Outside task scope on a device with the developer's privileges. Stopped on the endpoint.
Query a customer table through a database MCP server	mask	The query runs. Personal data is masked in the response before it enters the model context.
Call an MCP server not on the approved list	human-in-the-loop	A new door. The agent's owner reviews it once, then policy remembers the answer.
Paste a repository secret into an external API	deny	Recognised at the point of exfiltration and blocked in-line.

Verdicts are illustrative defaults. Every row is a policy you write once and Agen enforces per action, per identity.

Book a demo

See Claude Code governed, live.

Thirty minutes on the way your teams already use Claude Code. We show the verdict on each action, the named human behind the session, and the record it leaves. Bring your hardest question.

length30 minutes

formatlive, on your Claude Code setup

you seeevery action decided at runtime

Watch it happen

Claude Code reaches for a production secret. On a laptop.

It never crosses your network controls, and no log outside that machine would record the attempt. AgenShield stops it on the device and records who, what and why.

on-device block · live product scene

From install to governing

Rolled out like software. No developer workflow changes.

Claude Code stays exactly as your engineers use it today. The change is on the security side.

Day 1

Ship AgenShield through your MDM

AgenShield deploys to developer machines with the tooling you already use. Nothing to install in the terminal. Cloud sessions and MCP servers route through the gateway.

Day 1

Connect your IdP

Sessions resolve to developers through Okta, Entra or any OIDC provider. No new directory, no agent registry to populate by hand.

Week 1

Run observe-only

See every Claude Code action across the fleet before enforcing anything. Discovery lands in days and exposes the MCP servers you did not know about.

Week 2

Turn on the policies that matter

Start with secrets and production. Enforce per agent, per system or per action. Developers only notice the crossing action.

The platform

Discover, Govern, Shield. One policy plane.

The same three capabilities govern Claude Code and every other agent you run, internal and external.

Expand a capability

Continuous discovery across your IdP, gateway, devices, cloud, and registries. Nothing has to self-register: agents are found, risk-scored, and resolved to a named human before they act.

Agentless and API-based across five surfaces
First-party, custom, and third-party agents alike
Every agent mapped to an owner, approver, and escalation

Agen Discover AI agent discovery flow: any identity provider, productivity suites and assistants, cloud, gateway, endpoints, and MCP server registries all feed one agent registry where every AI agent is inventoried, risk-scored on arrival, given a named human owner, and shadow AI is surfaced. — Discovery pulls from five surfaces into a single agent registry — no SDK self-registration required.

ClosesWhich agents are running that nobody registered?

no SDK required5 surfacesowner-mapped

Discover in depth →

Every request is evaluated against the identity behind the agent and answered in under 30ms: allow, mask, step up, hand to a human, or deny. The action is where the risk lives, so the action is where the decision happens.

Per-action verdicts anchored to the human behind the agent
Step-up and human-in-the-loop only when policy is crossed
Evidence generated at action time, not reconstructed later

Agen Govern runtime AI agent governance flow: an attempted action such as an assistant reading a document, an agent exporting records, or a custom agent writing to production is resolved to the identity behind the agent and checked against policy in 22 milliseconds, returning a per-action verdict of allow, mask, step-up, human-in-the-loop, or deny. — Every agent action is judged in-line against the human behind it, and answered in under 30ms.

ClosesWho approved this action, and who is accountable for it?

<30ms verdictstep-uphuman-in-the-loop

Govern in depth →

One policy plane enforced identically on the endpoint, in the browser, at the gateway, and in the cloud. Agent risk lives in the gaps between point tools, so there are no gaps to live in.

AgenShield stops dangerous local actions before they execute
BrowserShield catches company data at the paste (early access)
One policy, one identity chain, enforced the same way everywhere

Agen Shield AI agent enforcement flow: one policy plane written once in Govern and anchored to the same identity is enforced identically on the endpoint with AgenShield, in the browser with BrowserShield, at the gateway across 150+ connectors, and in the cloud across SaaS and internal apps. — One policy, written once, enforced the same way on every surface where agents actually run.

ClosesWhat happened on the laptop and in the browser that no log saw?

endpointbrowsergateway · cloud

Shield in depth →

FAQ

Questions, answered.

Does Agen replace Claude Code's permission settings and hooks?

No. Engineering keeps settings.json, managed settings and hooks. Agen adds a central verdict on each action, anchored to the developer's identity, and a record that exists outside the machine. The two layers do different jobs.

Does it slow Claude Code down?

No. The verdict returns in under 30ms on the device, in-line with the action. A developer notices nothing until an action crosses policy, and then only that action pauses.

Can we govern Claude Code running in CI or in a cloud session?

Yes. The same policy plane governs the endpoint, the gateway and the cloud. Sessions running in GitHub Actions or in a hosted environment are tied to the identity that launched them and judged by the same rules.

What about MCP servers Claude Code connects to?

Every MCP call is an action, and each one is judged. Servers can be discovered, approved once by the agent's owner, and routed through the MCP Gateway so the tokens never sit in a local config file.

Is this sold to individual developers?