Governance for Claude Code and coding agents

A coding agent with a shell is the most useful and most dangerous agent most teams run. Descles keeps the Anthropic credential off laptops and puts a policy in front of the tool calls it proposes.

Route it without touching the developer's workflow

Claude Code reads its own environment variables, so the change is two lines per machine, pointing at your organization's edge. The Anthropic key lives on the edge, not on any laptop.

export ANTHROPIC_BASE_URL=https://descles.internal/anthropic
export ANTHROPIC_AUTH_TOKEN=<agent-key>
# the Anthropic key stays on the edge; no provider key on this machine

Tool names are exactly what the client declares

Rules match the names Claude Code emits — Bash, Read, Edit, Write, WebFetch. A rule for a name the client never declares governs nothing, and there is no fuzzy matching, so a typo is silently inert. The console shows the effective status of every tool after a policy is applied, which is how you catch that before it matters.

defaults:
  tools:
    Bash: require_approval
    Read: allow
    Edit: require_approval
    Write: deny
    WebFetch: allow

Check shell and file actions before they run

Model-proposed tool calls are only half of it: Claude Code runs Bash, Edit and Write on the machine. With the Descles edge, descles connect installs Claude Code hooks that ask the edge about each of those actions before it runs, under the same policy, and report what ran afterwards. Hermes gets the same through its hooks. Codex has no pre-execution hook, so there only model calls and MCP tools are covered.

descles connect claude-code --edge https://descles.internal --key <agent-key>
descles doctor --edge https://descles.internal   # checks nothing bypasses the edge

A rule on a shell command matches the command the model asks for, so an obfuscated command can slip past a pattern. Keep Claude Code's own sandbox, and put anything that must never be bypassed behind an MCP connector whose credential only the edge holds.

Why teams want this

The credential stops being a personal possession: an org key can be rotated once, and every machine that was using it is out of date immediately. Spend becomes a number with a name attached per day instead of a mystery on someone's card. And the destructive command that would have run unattended is a decision someone made and a record that names them.

Through the gateway alone, Descles decides on the tool call the model proposes and the machine runs it; with the edge's hooks, it also checks the action before it runs. Either way keep a sandbox around the agent, and treat a command-string rule as a speed bump.

Questions

Do developers have to change how they run Claude Code?

Only the two environment variables, or one descles connect command that also installs the pre-execution hooks. No provider key goes on their machine.

Can one developer's budget be capped separately?

Yes. Limits apply per agent and per group, with agent rules taking precedence, and a group of people can be capped together while an individual stays tighter or looser.

Does it work with other coding agents?

Any client that speaks the OpenAI or Anthropic protocols, including agents that declare Hermes-style tool names such as terminal, execute_code or read_file.

Agent approvals — Autonomy is fine until the tool call is `kubectl delete pod checkout-api` in production. Approval puts one named person in that gap, and only for the calls that need it.
LLM gateway — One endpoint for every agent, one key per agent, and a decision on every request: authenticated, attributed, budgeted, recorded, then forwarded to your provider with a key only the gateway holds.
MCP security — An MCP server turns a model into something that can act. Governance is the layer that decides which of those actions may happen, and leaves evidence behind either way.
Documentation — endpoints, provider keys, and the full policy reference.

Try it: run the open-source edge, or apply as a design partner. Questions: outreach@descles.com. See also terms and privacy.