How to Run Claude Agents in a Sandboxed Enterprise Environment

Once an agent can run commands, read files and call internal APIs, a security team will reasonably ask what prevents it from causing damage. Instructions in the prompt aren't a sufficient answer.

Treat the agent's actions as an untrusted workload and contain them.

Step 1: Isolate execution

Run the agent's tools in a container or virtual machine used only for that task:

• Use a minimal image that includes only the tools the agent needs.
• Mount only the directories it needs, read-only where possible, with no other access to the host.
• Create a new environment for each task or session and destroy it afterwards.

For coding agents, Claude Code supports sandboxing and development containers, which provide much of this isolation already.

Step 2: Restrict network access

Block outbound traffic by default and allow only what's required, such as your package mirror and specific internal APIs. Send traffic through a proxy that logs requests. If the agent is manipulated into trying to send data out, it has nowhere to send it.

Step 3: Keep secrets out of the sandbox

Don't store long-lived credentials inside the environment. Safer options include:

• A proxy that adds credentials to approved requests as they leave the sandbox.
• Short-lived tokens with narrow permissions, issued for each task.
• Managed services that add credentials at the network boundary, such as the vaults in Anthropic's managed agents service.

Step 4: Limit permissions

Give the agent a service identity with the minimum access it needs: read access where it only reads, write access to a single staging area and no permission to deploy to production. Use separate identities for each customer.

Step 5: Require approval for significant actions

Deployments, deletions, payments, emails to customers and permission changes should need a person's approval. The approval request should show exactly what will happen.

Step 6: Log everything

Record prompts, tool calls, inputs, outputs and network requests with timestamps and task IDs. You'll need these records for incident investigations, audits and improving the agent.

Step 7: Choose where the model runs

If data residency matters, consider using Claude through a cloud provider your customer has already approved, such as Amazon Bedrock, Google Cloud Vertex AI or Microsoft Foundry. Check which features are available on that platform.

Other risks

• Package registries can be used to exfiltrate data or introduce malicious code. Use a mirror and pin versions.
• Repositories can contain text written to manipulate agents. Treat mounted content as untrusted.

Go through these steps with your security team early. Adding controls after a pilot is much harder than designing them in.