# Scan: Claude Code, on your own machine

> GAMMA-Ray v0.0.3 (beta, for review; every rating is experimental). An example GAMMA-Ray beta rating of Claude Code, on your own machine: freedom 2, 2, 4, 2, 5 across its configurations; deployment governance not assessed.
> Page: https://gamma-ray.sgit.ai/scans/claude-code-local/ · Source: data/scans/claude-code-local.json


Example · beta rating · a product as its vendor documents it · read 2026-11-10 · not seen by the vendor

The command-line coding agent, running as the user’s own account on their machine, with the settings it ships with.

An example scan of a product as its vendor documents it, not of any one deployment. Disclosure: the agent that wrote this scan runs on this product.

Built only from the vendor’s own documentation and a published deployment shape. Nothing was tested. If you are the vendor and something here is wrong, the correction will be made and dated.

*Figure. The label for this rating; its contents are in the text.*

2 Freedom as shipped Suggests 5 Freedom at most Coordinates 8 Controls it brings as shipped n/a Deployment governance not assessed

## How to read it

This is a product, not a deployment. A product has no owner, no policy in force and no mandate until somebody runs it, so it is given **no governance level and no level held**: those belong to a deployment. What a product has is a freedom level for each way it can be configured, and a list of the controls each configuration brings.

*Figure. The freedom level of each configuration; the table has the same.*

| Configuration | What changes | Freedom | Controls | Turned on by the operator |
|---|---|---|---|---|
| **As shipped** | Manual mode: shell commands and edits ask first. | 2 Suggests | 8 | nothing |
| **Sandbox on** | Shell commands confined by the operating system. | 2 Suggests | 9 | a limit on it is enforced by something outside its own reach |
| **Auto mode** | A classifier reviews actions instead of the person. | 4 Acts widely | 8 | the agent works independently; the person approves critical decisions only |
| **Managed by an organisation** | Managed settings, permission rules and telemetry. | 2 Suggests | 12 | its autonomy limits and the tools it may use are defined; its actions are logged; it is monitored in operation; policy is enforced as machine-readable rules |
| **Auto mode, tools and agent teams** | Everything that widens what it does. | 5 Coordinates | 8 | it connects to external tools or services across a trust boundary; the agent works independently; the person approves critical decisions only; several agents coordinate inside the organisation |

The same product is a different agent in each row. A rating of a deployment starts by saying which row it is.

An indicator with no evidence is reported as not evidenced; it is never read as a no.

## The profile

*Figure. One square per indicator, by question; every answer is listed below.*

## The grant: what it can actually do

The questions measure what is said about an agent: its purpose, its rules, its controls. The grant is the other half: what its permissions let it do, capability by capability, and what stands in the way of each. This is RiskMandate's measurement, and it depends on the permissions a deployment was given.

*Figure. The grant as a grid of capabilities; the table below has every row.*

| | |
|---|---|
| The grant | 16 of the 23 capabilities |
| Behind a boundary (the only barrier that is a control) | 0 |
| With nothing, a rule in prose or a setting in the way | 16 |
| Capabilities whose effect cannot be undone | 8, of which 8 are not behind a boundary |
| Rows observed or measured on the thing itself | 0 of 16 |
| The mandate | none: a product has no mandate until an operator writes one, so there is no delta to compute |

Source: [anthropic/claude-code/local-default](https://abp.sgit.ai/data/profiles/anthropic/claude-code/local-default.json), profile version 2026-09-05. Its publisher states: "This describes a published deployment shape. It is not an assessment, an audit, a certification or a security review of any named product, and it carries no adjective and no score." The counts above are that profile's rows, counted.

| Capability | Barrier | How it is known |
|---|---|---|
| `authenticate-as.credential.signing` | none | documented |
| `authenticate-as.credential.tenant` | none | derived |
| `create.record.world` | none | documented |
| `delete.file.host` | none | derived |
| `read.credential.host` | none | documented |
| `read.file.host` | none | derived |
| `read.record.history` | none | documented |
| `send.endpoint.world` | none | derived |
| `write.file.host` | none | derived |
| `write.file.project` | none | derived |
| `write.repository.project` | none | derived |
| `write.repository.tenant` | expectation | derived |
| `execute.process.host` | setting | derived |
| `create.schedule.host` | none | derived |
| `read.file.project` | none | derived |
| `grant.credential.self` | setting | derived |

## What its evidence reaches

*Figure. The mashup graph with this agent's evidenced indicators lit.*

## Every answer, with its source

### What is the agent built on?

- *Not evidenced.* It is a vendor's assistant, used as supplied.
- *Not evidenced.* It runs on an AI platform with the organisation's own data, without executing arbitrary code.
- *Not evidenced.* It is configured on a low-code or no-code builder and acts on real organisational data.
- **As shipped.** It generates and executes code with local or cloud privileges. The vendor calls it "an agentic coding tool that reads your codebase, edits files, runs commands". [Source](https://code.claude.com/docs/en/overview) (documented)
- *Not evidenced.* It is built in-house: the organisation controls its identity, tools and boundaries.

### Does it act, or only answer and recommend?

- *Not evidenced.* It follows fixed rules, with no reasoning.
- *Not evidenced.* It retrieves information and recommends actions; a person acts.
- **As shipped.** It executes actions itself. It edits files, runs commands, stages changes, commits and opens pull requests. [Source](https://code.claude.com/docs/en/overview) (documented)

### How far does it reach?

- *Not evidenced.* It works in one domain's data.
- **As shipped.** It works across several domains or systems. The codebase, the shell, git and the development tools it integrates with. [Source](https://code.claude.com/docs/en/overview) (documented)
- **Available, if the operator turns it on.** It connects to external tools or services across a trust boundary. It can connect to Model Context Protocol servers; a project’s servers have their own approval prompt. [Source](https://code.claude.com/docs/en/security) (documented)

### Does it work with other agents?

- **Available, if the operator turns it on.** Several agents coordinate inside the organisation. Agent teams coordinate several instances, each in its own context, that message each other. The vendor says they "are experimental and disabled by default". [Source](https://code.claude.com/docs/en/agent-teams) (documented)
- *Not evidenced.* Agents operate across organisational boundaries or disparate stacks.
- *Not evidenced.* There is a published protocol or communication layer between agents.

### What is the person's role?

- *Not evidenced.* The person operates: every action is prompted and controlled by them.
- **As shipped.** The agent suggests; the person reviews and approves each action. In Manual mode shell commands and edits ask before they run; file reads in the working directory do not. [Source](https://code.claude.com/docs/en/permissions) (documented)
- *Not evidenced.* The agent handles routine tasks; the person is consulted on exceptions.
- **Available, if the operator turns it on.** The agent works independently; the person approves critical decisions only. Other permission modes change what asks; in auto mode a classifier reviews actions instead of the person. [Source](https://code.claude.com/docs/en/permissions) (documented)
- *Not evidenced.* The agent has full autonomy within boundaries; the person monitors.

### Is what it is for written down?

- **As shipped.** Its purpose and permitted tasks are stated in writing. The vendor states what the product is for. [Source](https://code.claude.com/docs/en/overview) (documented)
- **Available, if the operator turns it on.** Its autonomy limits and the tools it may use are defined. Allow, ask and deny rules per tool and pattern. [Source](https://code.claude.com/docs/en/permissions) (documented)
- **As shipped.** Its limits and known failure cases are documented for those who use it. The security page states limits, for example that an approved shell command can write anywhere the account can. [Source](https://code.claude.com/docs/en/security) (documented)

### Does it have its own identity and only the access it needs?

- **Claimed, not counted.** What it can reach is enumerated: scopes, permissions, tools. A published deployment shape lists 16 capabilities; most rows are derived, not measured. [Source](https://abp.sgit.ai/data/profiles/anthropic/claude-code/local-default.json) (documented; this fact has to be observed or measured to count)
- *Not evidenced.* Its authorisation is published as metadata that anyone can read.
- *Not evidenced.* It asks for narrower access than the whole account.
- *Not evidenced.* It has its own identity, separate from any person's.
- *Not evidenced.* Its identity is cryptographic and can be checked by others.
- *Not evidenced.* Its tokens are bound to the service they were issued for and are not passed on.

### Is it in a registry, with an owner?

- *Not evidenced.* The organisation keeps a registry of its agents.
- *Not evidenced.* Each agent has a named owner.
- *Not evidenced.* Agents are retired by a defined process.

### Who is accountable for it?

- *Not evidenced.* A named executive or body is accountable for the organisation's agents.
- *Not evidenced.* Roles and responsibilities for AI risk are documented.

### Is there a policy that governs it?

- *Not evidenced.* A governance policy for agents is published.
- *Not evidenced.* Agents and use cases are classed by risk.
- *Not evidenced.* The laws that apply to it are identified.
- *Not evidenced.* New agents pass an approval or review before they run.

### Can a person step in or stop it?

- **As shipped.** High-impact actions need a person's approval. Shell commands (beyond a read-only set) and edits need approval in Manual mode. [Source](https://code.claude.com/docs/en/permissions) (documented)
- **As shipped.** There is a way to pause or stop it. A deny rule removes a tool; the person can refuse any prompt. [Source](https://code.claude.com/docs/en/permissions) (documented)
- *Not evidenced.* There is a defined escalation path.

### Is what it does logged?

- **Available, if the operator turns it on.** Its actions are logged. Tool activity can be exported as OpenTelemetry events; it is configured by the operator. [Source](https://code.claude.com/docs/en/monitoring-usage) (documented)
- *Not evidenced.* The log is tamper-evident and kept for a stated time.

### Is it watched while it runs?

- **Available, if the operator turns it on.** It is monitored in operation. Usage, cost and tool activity across an organisation, through OpenTelemetry. [Source](https://code.claude.com/docs/en/monitoring-usage) (documented)
- *Not evidenced.* Anomalies are detected in real time and raise alerts.

### What stands between it and what it should not do?

- **Available, if the operator turns it on.** A limit on it is enforced by something outside its own reach. Sandboxing restricts shell commands at the operating system level (filesystem and network); the operator turns it on. [Source](https://code.claude.com/docs/en/sandboxing) (documented)
- **As shipped.** A limit on it is a setting that its own account could change. "The boundary is a permission prompt, so a Bash command you approve can still write anywhere your user account can." [Source](https://code.claude.com/docs/en/security) (documented)
- *Not evidenced.* A limit on it is a rule in prose.
- **Available, if the operator turns it on.** Policy is enforced as machine-readable rules. An organisation can deliver managed settings that a user’s own files do not change; hooks run on every tool call and can block it. This is an enforcement mechanism, not a policy. [Source](https://code.claude.com/docs/en/settings) (documented)
- *Not evidenced.* The difference between what it can reach and what it is for is stated.

### Is it tested, and are the results shown?

- *Not evidenced.* Test or evaluation results are published.
- *Not evidenced.* It is tested for safety and security, including by attack.
- *Not evidenced.* People who did not build it take part in assessing it.

### What happens when it goes wrong?

- *Not evidenced.* There is an incident process for agents.
- *Not evidenced.* Incidents and errors are communicated to those affected.
- *Not evidenced.* There is a plan for a failure of a third party it depends on.

### Do people know it is an AI, and can they answer back?

- *Not evidenced.* It tells the people it talks to that it is an AI.
- *Not evidenced.* There is a channel to report problems with it or contest its output.

### What data does it use, and under what rules?

- *Not evidenced.* The data it uses is described.
- *Not evidenced.* There are data quality rules for what it reads.
- *Not evidenced.* Its privacy risk has been examined.

### What does it depend on from others?

- **As shipped.** The models and third-party components it uses are listed. The product and its model family are named. [Source](https://code.claude.com/docs/en/overview) (documented)
- *Not evidenced.* Third-party components are monitored and have risk controls.

### Has anyone independent checked?

- **As shipped.** A public certificate or audit report covers it. The vendor points to a SOC 2 Type 2 report and an ISO 27001 certificate at its trust centre; they cover the vendor, not a user’s deployment. [Source](https://code.claude.com/docs/en/security) (documented)
- *Not evidenced.* Compliance evidence is produced continuously, ready for a regulator.

### Is the organisation behind it ready?

- *Not evidenced.* There is a stated strategy for agents.
- *Not evidenced.* The people who work with it are trained.
- *Not evidenced.* Its value is measured.
- *Not evidenced.* It is improved on a regular cycle.
- *Not evidenced.* The organisation's risk management covers agents.

## The vault

This rating, its evidence list, its grant and the questions it was made against are kept in a public sgit vault (`08k79drk`, published 2026-11-10). Anyone can read it with this key:

`sgit_public_read_04133526e7f502cb0c0a0e18705b0b34195413427a40eb785512bd74df17b880:08k79drk`

With [sgit](https://sgit.ai/): `sgit clone sgit_public_read_04133526e7f502cb0c0a0e18705b0b34195413427a40eb785512bd74df17b880:08k79drk`. The key reads; it cannot write. An operator who wants to add what only they hold forks the vault into a private one.