Wait, don't aim for zero risk? Anthropic's new playbook for CISOs in the age of agentic AI

Hey friends, it's Shii-chan! Today's piece is more about governance than tech, but I found it genuinely mind-shifting, so let me share it. It came straight from the security world, and it gave me a bit of a jolt!

Claude Blog claude.com

What was announced?

The Claude Blog published a piece by Jason Clinton, Anthropic's Deputy CISO, titled "Zero risk isn't the job: a CISO's guide to agentic AI." Dated July 17, 2026, it opens with a claim that sounds surprising at first: when you deploy agentic AI, a security leader's job isn't to drive risk to zero.

Clinton argues that a security leader's real job is to make agentic risk "legible and bounded," rather than trying to eliminate it. That way, organizations can deliberately accept manageable risk instead of getting swept along by shadow adoption happening under the radar.

Why it matters

The piece sorts agentic AI's risks into two buckets: external threats and internal risks. On the external side, it points out that frontier models are finding serious vulnerabilities in well-known software like OpenBSD and Firefox, bugs that human reviewers missed for years. On the internal side, it names data leaks and prompt injection.

If organizations wait around for formal governance to arrive, teams won't wait for it either, and they'll start using agents on their own, which is exactly how shadow AI takes hold. That's why building a system to name risk clearly and accept it deliberately matters so much for keeping pace with how fast these models are evolving.

What changes

Clinton lays out four questions for evaluating any agentic use case.

• Untrusted content ingestion: does the agent process anything an attacker could write or alter, like external email, the public web, or third-party documents?
• Actions and authority: what can it do, and under whose identity? Read-only access is a different story from read/write.
• Blast radius: if it goes off the rails, how far does the damage spread, from a single file up to the whole organization?
• Observability: can you tell the agent's actions apart from the user's? Does that activity actually land in your SIEM?

He also lays out two poles for how agents carry identity: system service accounts, which are single-purpose, least-privilege identities with no human attached, versus personal agents that run on human credentials.

"The middle of the spectrum, where an agent carries a person's delegated identity into systems that person is not watching, is where accountability gets ambiguous."

In other words, the messiest case for accountability sits in the middle ground, where an agent carries someone's delegated identity into systems that person isn't actually watching.

Dive Deep

The piece backs this up with real examples. Inside Anthropic, an incident-response agent runs with read-only access to production logs, a Slack integration, and the ability to create Google Docs. After it was upgraded from Claude Opus 4 to Claude Opus 4.5, the agent autonomously reached out to another agent to generate a code fix and tried to resolve a production issue on its own, all within a controlled scope that still required human review.

The other example is Claude Cowork, which sits closer to the human-operator end of the spectrum. It bakes in security controls like these:

• Identity integration: SAML / OIDC sign-in with SCIM provisioning
• Connector allowlists: admins set the data boundaries
• Per-tool, per-action restrictions: fine-grained controls, like blocking outbound email specifically
• Sandboxed execution: agent logic runs in isolated, temporary sandboxes, and credential injection prevents exfiltration
• Egress allowlisting: mandatory proxies limit outbound traffic to approved destinations only
• OpenTelemetry streaming: every tool invocation logs to your SIEM with user identity and context attached
• Organization-wide off switch: a single toggle disables connectors across every user

The piece rolls all of this up into seven requirements for agent governance: identity must come from your own identity provider, connector allowlists establish data boundaries, per-tool per-action approval enables granular control, sandboxed execution isolates agents from production credentials, egress allowlisting prevents data exfiltration, telemetry routes to your SIEM, and organization-wide kill switches enable rapid response.

Governance itself doesn't have to become a bottleneck, which is a point worth calling out. Anthropic's own GRC (governance, risk, and compliance) team uses agents to respond to security questionnaires and review vendor flags. Three lessons came out of that experience:

• Automate the risk register: quarterly reviews can't govern systems that change faster than the documentation process
• Understand who's building and why: when non-engineers can build tools with Claude Code, shadow adoption drops
• Embed human accountability: risk acceptance needs sign-off from an authorized person, integrated with frameworks like ISO 42001

Clinton also warns against designing controls around what today's model can do.

"If you design your new program for what the model can do today, you will be behind by the time your program launches."

In other words, design for roughly a six-month capability horizon, or your program will already be outdated by the time it launches. As models get smarter, elaborate scaffolding and painstaking prompt tuning keep becoming unnecessary anyway.

Finally, the piece offers three steps you can start on today:

• Run your highest-pressure agentic use case through the four questions above to figure out what approval conditions it needs
• Ask your identity provider, your SIEM, and your agent vendors which of the seven requirements they can demonstrate right now
• Define what counts as "untrusted content" in your own environment, and write it down

Wrap-up

• Anthropic's Deputy CISO Jason Clinton published a governance piece on the Claude Blog built on the premise that agentic AI risk can't be eliminated
• The evaluation framework rests on four questions: untrusted input, authority, blast radius, and observability
• Identity design should be thought of as a spectrum between system accounts and human credentials
• Real examples from Claude Cowork and an internal incident-response agent inform seven governance requirements
• It also covers designing for a six-month capability horizon and three steps you can take today

This one's for CISOs and security teams weighing how to roll out agentic AI, and honestly for any engineer who wants to understand the governance groundwork underneath it!