Governance for Claude Code and coding agents

A coding agent with a shell is the most useful and most dangerous agent most teams run. Descles keeps the Anthropic credential off laptops and puts a policy in front of the tool calls it proposes.

Route it without touching the developer's workflow

Claude Code reads its own environment variables, so the change is two lines per machine — or one stored credential in the console and no provider key on the machine at all.

export ANTHROPIC_BASE_URL=https://anthropic.gw.descles.com
export ANTHROPIC_AUTH_TOKEN=<agent-descles-key>
# store the Anthropic key once in the console (hosted BYOK);
# no provider key stays on this machine.

Tool names are exactly what the client declares

Rules match the names Claude Code emits — Bash, Read, Edit, Write, WebFetch. A rule for a name the client never declares governs nothing, and there is no fuzzy matching, so a typo is silently inert. The console shows the effective status of every tool after a policy is applied, which is how you catch that before it matters.

defaults:
  tools:
    Bash: require_approval
    Read: allow
    Edit: require_approval
    Write: deny
    WebFetch: allow

Why teams want this

The credential stops being a personal possession: an org key can be rotated once, and every machine that was using it is out of date immediately. Spend becomes a number with a name attached per day instead of a mystery on someone's card. And the destructive command that would have run unattended is a decision someone made and a record that names them.

The same boundary as everywhere else: Descles decides on the tool call the model proposes, and the machine runs it. Keep a sandbox around the agent, and treat a command-string rule as a speed bump.

Questions

Do developers have to change how they run Claude Code?

Only the two environment variables — or nothing at all on their machine if the credential is stored in the console and they authenticate with a scoped Descles key.

Can one developer's budget be capped separately?

Yes. Limits apply per agent and per group, with agent rules taking precedence, and a group of people can be capped together while an individual stays tighter or looser.

Does it work with other coding agents?

Any client that speaks the OpenAI or Anthropic protocols, including agents that declare Hermes-style tool names such as terminal, execute_code or read_file.

Agent approvals — Autonomy is fine until the tool call is `kubectl delete pod checkout-api` in production. Approval puts one named person in that gap, and only for the calls that need it.
LLM gateway — One endpoint per provider, one key per agent, and a decision on every request: authenticated, attributed, budgeted, traced, then forwarded.
MCP security — An MCP server turns a model into something that can act. Governance is the layer that decides which of those actions may happen, and leaves evidence behind either way.
Documentation — endpoints, provider keys, and the full policy reference.

Try it on one agent: 1,000 governed requests free, no card. Request packs add 25,000 more to the same workspace. Questions: outreach@descles.com. See also terms and privacy.