Announcing Industry’s First Context-Aware Runtime Decision Engine to Enforce AI Agent Actions

AI Agent Security for Claude

Check Claude agent actions before they reach your apps

See what Claude Code and Cowork agents can reach, cut the access they don’t need, and check each tool call against your policy before it runs.

Request a demo
Watch Video

Trusted By

Claude agents act in seconds, with everything their user can reach

A mistaken or misled agent can do anything its user could in apps like Salesforce and Snowflake.

Claude agents without guardrails

With Obsidian

Destructive actions run before anyone sees them

A report reviewed the next morning arrives after the data has left or the table is gone.

Shadow agents skip security review

Developers connect Claude to company apps and MCP tools on their own, so those agents act without any security decision.

Sensitive data leaves through unsecured agents

Claude Code can read SSH keys into its context, and Cowork can query a Snowflake table and post the results to Slack.

Each Claude tool call is checked against your policies before it runs.

Unsanctioned MCP servers and apps are found, and calls to them can be blocked.

Each agent’s access to credentials and sensitive data is mapped, so you can scope it down.

Instantly see every agent your users publish and run

Least privilege
Sensitive data
MCP and tools
Runtime guardrails

Cut the admin access Claude agents don’t need

Find the Claude Code and Cowork agents that hold more access than their work needs, and scope them back before that access gets used.
Findings for agents with admin rights in production apps, such as an admin role in Snowflake or GitHub
Risk factors scored by criticality, so you know what to fix first

Keep credentials and sensitive data out of Claude’s reach

See which credentials and sensitive data each agent can reach, then scope that access or block it with policy.
Detection of agents that can read cloud credentials or private keys, and skills with hardcoded secrets
Policies built on your own data classification labels

Keep Claude agents inside the tools you’ve approved

See the tools your Claude agents connect to, and block calls to the ones you haven’t approved.
Inventory of the models, skills, hooks, plugins, and MCP servers your Claude agents use
Findings for local MCP servers and unsanctioned plugins or marketplaces, and policies that block calls to them
MCP Security Proxy for supported apps, which identifies the user, keeps the app’s token out of the AI client, and checks each tool call against policy

Stop destructive actions before they run

Set runtime guardrails on what Claude agents do, scoped to the users, agents, and actions you choose. Test each one with Flag on real traffic before you enforce it.
Flag or block, plus require approval for Claude Code policies that run before an operation
A record of each decision with the agent, the person behind it, the tool and its arguments, the matching policy, and the reason

What happens when a Claude agent calls a tool

Claude calls a tool

An Obsidian sidecar running alongside Claude Code or Cowork pauses the call. The call carries the agent, the person behind it, the tool, and its arguments.

The Runtime Policy Decision Engine checks it

It weighs the call against your policies using available identity, HR, and application context and your own data labels.

The engine returns a decision

Allow, block, or require approval where supported, along with the reason. A call that matches no policy proceeds.

The decision is applied

The action proceeds, waits, or stops, and the decision is logged. In Claude Code, the user sees the message the policy author wrote.

Where Claude agent actions slip past your existing controls

Claude agents act through MCP, OAuth, and direct integrations, and each of your controls sees only part of the action. Obsidian keeps those controls and adds one decision that sees the whole chain: person, agent, credential, tool, app, and data.

Agent actions often skip network gateways

Claude reaches apps through OAuth, APIs, and MCP servers, often without passing a network gateway. The Obsidian sidecar checks each tool call on the user’s machine, before it reaches the app.

Identity authorizes access, not actions

A valid login says who can get in, not whether an action should run. Obsidian adds identity and employment context, so a login alone doesn’t decide whether an agent drops a production table.

Approved tools still take damaging actions

An agent can use an approved MCP server and still export a full customer list. Obsidian checks the action itself, not just whether the tool is allowed.

Rules copied into each tool drift apart

Each agent platform, MCP connection, and gateway needs its own copy of a rule, and some have no runtime check. Obsidian applies one set of policies at each enforcement point it supports.

The architecture gap in agent security

See where Claude Code and Cowork actions travel through OAuth, APIs, and MCP servers, and where each layer of your security architecture loses sight of them.
Explore the architecture gap →

Additional resources

See Obsidian govern Claude Code and Cowork agents

Watch the video

Govern what Claude agents can access and do

Read solution brief

Runtime policy for Claude Code and Cowork: decide what Claude agents do with the access they inherit

Read  blog

Control what AI agents do in your third-party apps

Visit the MCP Security Proxy page

Frequently asked questions

Does Obsidian cover Claude Code and Cowork the same way?

Both get agent discovery and governance, plus runtime enforcement through a sidecar that checks each tool call before it runs. Require approval is available for Claude Code policies that run before an operation. Cowork policies can flag or block.

How do we test a policy before it affects developers?

Set the policy to Flag. It records matches on real Claude traffic without stopping anything, so you can confirm it catches the right actions before you switch it to block.

What context does a policy use?

Available identity, HR, and application context, plus labels you supply, such as data classification. Which signals a policy can use depends on the integration.

Does Obsidian replace Anthropic’s built-in controls?

No. Obsidian works alongside them. It narrows the access Claude agents hold across your apps and checks the actions that remain against your policies.

How does Obsidian handle Claude agents that reach apps through MCP?

Obsidian inventories the MCP servers your Claude agents use and flags unsanctioned ones. For supported apps, the MCP Security Proxy identifies the user, keeps the app’s token out of the AI client, and checks each tool call against policy.