Governing Claude Code

What this shows

Claude Code is a capable coding agent with a shell, a network stack and no obligation to tell you what it reaches for. This walkthrough puts one under Firma without modifying Claude Code at all, and governs it from a single place.

Launch it under governance

The session starts with firma run -- claude. That is the entire integration. Claude Code runs normally, and the agent appears in the Control Plane with its posture, its human-in-the-loop channel and any pending approvals. Nothing about the agent is patched, wrapped at the source level, or asked to cooperate.

Watch what it actually does

Asked to look up an IP address, the agent runs a shell command and reaches out to the network. The audit log fills in as it works, one row per outbound call, each normalized to an action class such as communication.external.send and resolved to Allow or Deny with the resource it touched. Calls you never asked about show up here too: telemetry endpoints the tooling contacts on its own are visible and, where policy says so, already being refused.

The log records the action class, host and path, and structural metadata. Credentials, request bodies and query strings are never captured.

Write a policy, switch it on

A new policy is written in the Control Plane's Policy Library as a Cedar rule, with a plain-language description alongside it:

forbid (
  principal,
  action == Firma::Action::"communication.external.send",
  resource == Firma::Resource::"api.ipify.org/"
);

Each policy carries an Enabled toggle. Policies live in the workspace rather than on any one machine, so switching one on distributes it to every agent under that authority at once, and switching it off withdraws it the same way. There is no redeploying agents and no editing config on individual laptops.

The next call is refused

The same request is made again. This time the call is denied at the enforcement point, and the audit row carries the reason: policy denied action communication.external.send on that resource. What the agent sees is a blocked connection.

The agent's own explanation is the part worth watching. It reports that the request is being blocked by a network policy restriction and says plainly that this is not something it can bypass. That is the difference between governance and instruction: the decision does not depend on the agent's cooperation, and it holds when the agent is wrong, confused, or compromised.