How do you secure Claude Code when it has access to production repositories?

Securing a coding agent with production repository access starts with scoping that access as tightly as the workflow allows. That typically means read only access wherever possible, restrictions to specific branches rather than the full repository, and no direct credentials for production deployment systems even if the agent is helping write deployment related code. Destructive or deploy affecting actions should require explicit human approval rather than being something the agent can execute autonomously, and every tool call the agent makes should be logged for audit purposes.

Configuration alone, however, only addresses the access an organization anticipated needing to restrict. It does not catch behavior that falls within the granted permissions but is still anomalous, such as an agent accessing an unusual number of files in a short window, or attempting to read configuration files that were not part of its assigned task. Static permission scoping is necessary but not sufficient on its own.

Runtime monitoring adds the layer that configuration cannot provide, flagging behavior that deviates from what is expected even when it technically falls within the agent's permitted access. This includes patterns like unexpected file access, attempts to exfiltrate data outside the repository, or actions that do not align with the task the agent was given. This is the kind of behavioral monitoring Akto's Argus applies to homegrown and third party AI agents operating in sensitive environments, giving security teams visibility into anomalies that access controls alone were never designed to catch, particularly in environments where a compromised or manipulated agent could otherwise operate undetected within its normal permission boundaries.