IAM for your Claude Code agent
Claude Code is a terminal-based coding agent that can inspect a working directory, edit code, run commands, and invoke configured tools from a development environment. Terminal access makes it effective for real maintenance work, but it also means an agent may encounter shell configuration, local credential helpers, checked-out repositories, generated logs, and environment variables that were never intended for a particular task. A request from an issue, a README, test fixture, or dependency output can also shape the commands it proposes. The safe operating model is to start in a minimal workspace, make the task and allowed repositories explicit, and provide external-service access through a separate identity rather than through every secret available to the shell.
Why does Claude Code need scoped credentials?
Claude Code sessions can be extended, iterative, and partly unattended. If a shell-exported token is available, the agent can use whatever that token permits when it reaches GitHub, Stripe, Supabase, Cloudflare, or a deployment service. That is a poor match for a narrowly defined task such as reviewing a pull request, querying a staging table, or preparing a release. A bounded identity separates the agent from a developer's accumulated workstation access and reduces the chance that a secret is exposed through a command, a debug print, or a conversation transcript. Gazebo lets you assign a profile to the Claude Code workload, record each credential retrieval, and revoke that profile when its purpose ends. Continue to use repository protections, confirmation gates for destructive commands, provider-side least privilege, and environment separation; credential mediation is a boundary, not evidence that an autonomous command is safe.
How Gazebo works with Claude Code
- 1
Connect only the services needed for the work and choose a provider credential whose permissions and environment already match the task. For example, use a repository-limited GitHub token or a staging database credential rather than a personal administrator token.
- 2
Create a distinct Claude Code access profile for the task, repository, or environment. Keep production, staging, and experimentation separate so a local debugging session cannot retrieve a production credential by default.
- 3
Configure Claude Code to use Gazebo's MCP server for credential retrieval. Remove or avoid broad service secrets from the shell environment used for the session, and keep MCP bearer tokens out of committed configuration.
- 4
When a tool needs a credential, Claude Code requests it through get_credential. Gazebo checks the profile and records the retrieval, providing a controlled path instead of asking the agent to discover or echo a secret in terminal output.
- 5
Review retrievals with the commands, changed files, pull request, and provider logs. Revoke the profile when a session, handoff, or incident ends. If the same work resumes, issue access deliberately rather than assuming a long-lived terminal session should retain it.
What this looks like in practice
Context-aware credential scoping
For review, use a repository-limited credential that can read the pull request and checks without creating branches, changing settings, or merging. If the agent later needs to open a branch or comment, make that a deliberate expansion. Keep merge authority behind your normal branch-protection and human approval process rather than treating a successful agent analysis as a release decision.
Prevent credential leakage into prompts
Do not paste secrets into a task prompt, shell command, or troubleshooting transcript. Use MCP retrieval at the point a configured tool needs a credential, and design scripts so they do not print headers, environment dumps, or connection strings. Redaction and careful logging still matter: any tool that receives a secret can leak it if its output is mishandled.
Per-project access profiles
Run separate sessions and profiles for separate repositories or clients. A migration assistant for one Supabase project should not inherit the GitHub, Cloudflare, or billing access used by another. At completion, revoke the profile and preserve the task, code review, and credential-access records needed for an audit or handoff.
Safer database investigation
For a production incident, begin with a read-only credential limited to the affected database or reporting path, and use a separate staging profile to reproduce a fix. Do not let a troubleshooting session inherit migration or administrator rights merely because it may eventually need them. If a schema change becomes necessary, review the proposed migration, backups, target environment, and rollback plan before enabling a distinct write-capable profile.
Set up Gazebo for Claude Code
Connect your services once. Your Claude Code agent gets exactly the access it needs — nothing more.
Get started freeServices Claude Code commonly connects to
Further reading
1Password for AI Agents and Gazebo: Two Credential Layers, How They Fit Together
1Password for Claude handles web login credentials for browsing agents. Gazebo handles programmatic API credentials for coding agents. They solve different layers of the same problem and can run together.
AI Agent Security Checklist: Cursor, Replit, and Copilot
Six things to do before shipping AI agents to production — scoped credentials, approval gates, audit logs, and a revocation path that doesn't take down everything else.
IAM for AI Agents: Identity Architecture for Autonomous Systems
The identity architecture for autonomous agents: scoped profiles, brokered credentials, approval gates, and lifecycle controls beyond human IAM.
What Is a Secrets Broker for AI Agents?
A secrets manager stores your credentials. A secrets broker controls which AI agent can retrieve them, under what conditions, and what it can do with them. Here's why the distinction matters.
OAuth 2.0 for Agents: Why Client Credentials Aren't Enough
OAuth 2.0's client credentials grant was designed for services, not autonomous AI agents. Here's what breaks at agent scale and what a better pattern looks like.
Using Gazebo with HashiCorp Vault: Adding AI Agent Access Controls to Vault
Vault handles infrastructure-grade secret storage. Gazebo adds per-agent identity, approval gates, and action-level audit logs on top — without changing how Vault is operated. How the two layers compose.