The simplest way to run a Claude agent is also the most common way to end up with an incident: give the agent your credentials and let it go.
This isn’t a criticism of Anthropic’s API. It’s an excellent API. The problem is what it doesn’t provide: the operational layer you need to run agents safely against real systems.
What You Get With Raw API Access
When you point Claude Code directly at external services, with nothing in between, you get:
- Full access, whatever your credentials allow. The agent can do anything you can do. If your AWS key has admin access, the agent has admin access.
- No action log. The Anthropic API logs your token usage. It doesn’t log what your agent did with those tokens, which systems it touched, or what it changed.
- No policy enforcement. There’s no layer between the agent and the resources it can reach. If you give it a command and it decides to take a broad interpretation, there’s nothing to stop it.
- No cost controls. You’ll know how much you spent on your next invoice. You won’t know until it arrives.
- No approval step. Destructive operations run if the agent decides to run them.
- No agent identity. If multiple agents share credentials, you can’t tell which one did what.
This is acceptable for: local development, prototypes, demos, personal tools with limited blast radius.
What Production Needs
| Capability | Raw API | What production needs |
|---|---|---|
| Action log | None | Every action recorded and searchable |
| Permissions | Whatever the credentials allow | Scoped per agent and per resource |
| Human approval | None | Sign-off before risky operations |
| Cost controls | Invoice after the fact | Per-session budgets and alerts |
| Agent identity | Shared credentials | One identity per agent |
| Runaway loop protection | None | Token limits and circuit breakers |
| Recovery | Hope you have backups | Point-in-time restore of data and files |
The Decision Framework
Raw API access is fine when:
- You’re building a prototype or proof of concept
- The agent only has access to your local machine
- No production data, no production credentials, no production systems
- You’re willing to lose anything the agent might touch
You need guardrails when:
- Any agent touches production systems
- Multiple agents share an environment
- You have a compliance requirement (SOC 2, HIPAA, GDPR)
- You’re running agents overnight or without human supervision
- Token costs matter to your budget
Build It, or Have It Run for You
Engineering teams can build this layer themselves: scoped credentials, logging, budgets, approval flows and backups, plus someone on call to watch it.
If you’d rather not build and run this yourself, Sentrely is a managed AI team, backed by real engineers, that builds, ships and monitors production-grade software in accounts you own. Every change runs through automated safety checks, important changes need human sign-off, and you get a 35-day rewind on data and files. Your team asks for work through an agent in your Slack. Book a free 30-minute call to see if it fits.