Run the agent with no entitlements

Where this comes from

In September 2026 JPMorgan put a hard monthly spending cap of 2,000 dollars on Claude Code for some of its engineers, and began moving them off their desktops into a containerized environment on AWS where the agent holds no credentials and reaches no internal system. Its chief information security officer gave the design rule in one sentence: agents should run in an ecosystem where they have no entitlements ^[20]. Anthropic runs its own engineers the same way, on remote machines whose outbound traffic is limited to an allow list ^[12].

The cap and the sandbox are one idea applied to money and to access. The agent gets a bounded budget and a bounded identity, both set by the team, and both enforced by the tool rather than asked for in prose. Rule 3 already does this for commands. This appendix does it for identity, network and spend.

It is optional because rule 3’s deny list and sandbox cover most of it for a team whose repository holds no customer data. Do the steps below when the repository does, when the developers’ machines hold things an agent should never see, or when a client’s security review asks how the agent is contained.

Step 1. Give the agent an identity that is not the developer’s

Do. Create a fine-grained GitHub token or a GitHub App installation scoped to the one repository, with contents and pull requests permission and nothing else. It is the identity the agent uses to read and to open pull requests. Store it where the agent runs, never in the developer’s shell profile. The agent gets no cloud credentials at all. Deploys run from CI on merge, which is non-negotiable 6.

Check. The token’s permission page on GitHub lists two permissions and one repository. gh auth status where the agent runs names that identity, not the developer’s account.

Step 2. Keep secrets out of reach

Do. The kit’s deny list already refuses reads of .env, secrets/, key files and ~/.ssh

. Add whatever else the repository holds: cloud credential files, certificates, fixture data with real records. On a Team or Enterprise plan, deliver the deny list as managed settings from the admin console so it cannot be removed by editing repository files ^[22].

Check. In a session, ask the agent to print .env. It reports the read was denied.

Step 3. Turn on the sandbox and the egress allowlist

Do.

The kit’s settings enable the built-in sandbox with network access limited to the package registries and the git host. The operating system enforces it for every command the agent runs ^[21]. Trim the domain list to what the stack uses. In managed settings, set

permissions.disableBypassPermissionsMode to disable so nobody can start a session that skips permissions.

Check. Run /sandbox in a session and confirm it is on. Ask the agent to fetch a page from a domain that is not on the list. The request fails.

Step 4. Move the agent off the desktop when the data warrants it

Do. Run sessions in a dev container or a cloud environment instead of the laptop: the reference container from Anthropic with its egress firewall, a container of your own, GitHub Codespaces, or Claude Code on the web. The agent then sees only the repository checkout and the identity from step 1. Do not mount ~/.ssh

or cloud credential files into the container; pass short-lived tokens as environment variables ^[22].

Check. Inside the container, ls ~/.ssh and ls ~/.aws ~/.azure find nothing, and claude starts and can open a pull request with the scoped identity.

Step 5. Set a hard spend cap per person, with a request path

Do.

In the admin console on a Team or Enterprise plan, set a spend limit per member or per group. For API billing, the Claude Code workspace has its own limit ^[14]. Pick the cap from Anthropic’s published usage, about 150 to 250 dollars per developer per month with 90 percent of users under 30 dollars a day, and write the request path in the governance file: who a developer asks for more, and what counts as a reason. The threshold from rule 11 stays as the early signal below the cap.

Check. The console shows the limit against each member. A developer who reaches it is stopped by the tool, not by a reminder.

Step 6. Turn on oversight

Do. Set CLAUDE_CODE_ENABLE_TELEMETRY=1

and point the OpenTelemetry exporter at the team’s collector, so cost and tool activity per developer arrive in near real time ^[23]. Keep the hooks, which block and log. Keep the pull request template’s “how it was built” section and the assisted label, which the kit has.

Check. Metrics for one test session appear in the collector within a minute. A merged pull request shows the tool, the instruction and the human changes.

Step 7. Write it down where it is enforced

Do. In docs/governance.md, record the agent’s identity and where it lives, the deny list additions, the sandbox domains, where sessions run, the cap and the request path, and where telemetry goes. Every line names the setting that enforces it.

Check. A new developer can read the governance file and set up their environment without asking anyone.

What this still does not stop

A developer who wants to can still run an agent outside all of this, on a personal account, on a personal machine. The pull request is what catches it: the template asks how the change was built, the same checks run, and the same reviewer reads it. As with appendix C, the controls here bound the agent. The pull request bounds the developer.