How do you secure Claude Code when it has access to production repositories?

Securing a coding agent with production repository access starts with scoping that access as tightly as the workflow allows. That typically means read only access wherever possible, restrictions to specific branches rather than the full repository, and no direct credentials for production deployment systems even if the agent is helping write deployment related code. Destructive or deploy affecting actions should require explicit human approval rather than being something the agent can execute autonomously, and every tool call the agent makes should be logged for audit purposes.

Configuration alone, however, only addresses the access an organization anticipated needing to restrict. It does not catch behavior that falls within the granted permissions but is still anomalous, such as an agent accessing an unusual number of files in a short window, or attempting to read configuration files that were not part of its assigned task. Static permission scoping is necessary but not sufficient on its own.

Runtime monitoring adds the layer that configuration cannot provide, flagging behavior that deviates from what is expected even when it technically falls within the agent's permitted access. This includes patterns like unexpected file access, attempts to exfiltrate data outside the repository, or actions that do not align with the task the agent was given.

Akto Argus applies this behavioral monitoring to homegrown AI applications and agents operating in sensitive environments, surfacing anomalies that access controls alone were never designed to catch, including a compromised or manipulated agent working quietly inside its normal permission boundaries.