# Scan: Claude Code on the web

> GAMMA-Ray v0.0.3 (beta, for review; every rating is experimental). An example GAMMA-Ray beta rating of Claude Code on the web: freedom 4, 4, 5 across its configurations; deployment governance not assessed.
> Page: https://gamma-ray.sgit.ai/scans/claude-code-web/ · Source: data/scans/claude-code-web.json


Example · beta rating · a product as its vendor documents it · read 2026-11-10 · not seen by the vendor

The same coding agent in a cloud session: a managed container with one repository attached and a proxy above it.

An example scan of a product as its vendor documents it, not of any one deployment. Disclosure: the agent that wrote this scan runs on this product, in this shape.

Built only from the vendor’s own documentation and a published, measured deployment shape. Nothing was tested. If you are the vendor and something here is wrong, the correction will be made and dated.

*Figure. The label for this rating; its contents are in the text.*

4 Freedom as shipped Acts widely 5 Freedom at most Coordinates 9 Controls it brings as shipped n/a Deployment governance not assessed

## How to read it

This is a product, not a deployment. A product has no owner, no policy in force and no mandate until somebody runs it, so it is given **no governance level and no level held**: those belong to a deployment. What a product has is a freedom level for each way it can be configured, and a list of the controls each configuration brings.

*Figure. The freedom level of each configuration; the table has the same.*

| Configuration | What changes | Freedom | Controls | Turned on by the operator |
|---|---|---|---|---|
| **As shipped** | The Default environment with Trusted network access. | 4 Acts widely | 9 | nothing |
| **A configured environment** | Network access, variables and a setup script set by the operator. | 4 Acts widely | 10 | its autonomy limits and the tools it may use are defined |
| **With agent teams** | Experimental; off by default. | 5 Coordinates | 9 | several agents coordinate inside the organisation |

The same product is a different agent in each row. A rating of a deployment starts by saying which row it is.

An indicator with no evidence is reported as not evidenced; it is never read as a no.

## The profile

*Figure. One square per indicator, by question; every answer is listed below.*

## The grant: what it can actually do

The questions measure what is said about an agent: its purpose, its rules, its controls. The grant is the other half: what its permissions let it do, capability by capability, and what stands in the way of each. This is RiskMandate's measurement, and it depends on the permissions a deployment was given.

*Figure. The grant as a grid of capabilities; the table below has every row.*

| | |
|---|---|
| The grant | 15 of the 23 capabilities |
| Behind a boundary (the only barrier that is a control) | 3 |
| With nothing, a rule in prose or a setting in the way | 12 |
| Capabilities whose effect cannot be undone | 7, of which 5 are not behind a boundary |
| Rows observed or measured on the thing itself | 13 of 15 |
| The mandate | none: a product has no mandate until an operator writes one, so there is no delta to compute |

Source: [anthropic/claude-code-remote/ccr-container](https://abp.sgit.ai/data/profiles/anthropic/claude-code-remote/ccr-container.json), profile version 2026-09-05.2. Its publisher states: "This describes a published deployment shape. It is not an assessment, an audit, a certification or a security review of any named product, and it carries no adjective and no score." The counts above are that profile's rows, counted.

| Capability | Barrier | How it is known |
|---|---|---|
| `authenticate-as.credential.signing` | none | observed |
| `delete.file.host` | none | observed |
| `read.credential.host` | none | observed |
| `read.file.host` | none | observed |
| `read.record.history` | none | observed |
| `authenticate-as.credential.tenant` | boundary | inferred |
| `send.endpoint.allowed` | boundary | observed |
| `execute.process.host` | none | observed |
| `write.file.host` | none | observed |
| `write.file.project` | none | observed |
| `write.repository.project` | none | observed |
| `write.repository.tenant` | setting | observed |
| `read.file.project` | none | observed |
| `create.schedule.tenant` | setting | self-reported |
| `create.schedule.host` | boundary | observed |

## What its evidence reaches

*Figure. The mashup graph with this agent's evidenced indicators lit.*

## Every answer, with its source

### What is the agent built on?

- *Not evidenced.* It is a vendor's assistant, used as supplied.
- *Not evidenced.* It runs on an AI platform with the organisation's own data, without executing arbitrary code.
- *Not evidenced.* It is configured on a low-code or no-code builder and acts on real organisational data.
- **As shipped.** It generates and executes code with local or cloud privileges. It runs Claude Code sessions in a cloud virtual machine. [Source](https://code.claude.com/docs/en/claude-code-on-the-web) (documented)
- *Not evidenced.* It is built in-house: the organisation controls its identity, tools and boundaries.

### Does it act, or only answer and recommend?

- *Not evidenced.* It follows fixed rules, with no reasoning.
- *Not evidenced.* It retrieves information and recommends actions; a person acts.
- **As shipped.** It executes actions itself. It clones the repository, makes changes and pushes branches. [Source](https://code.claude.com/docs/en/claude-code-on-the-web) (documented)

### How far does it reach?

- *Not evidenced.* It works in one domain's data.
- **As shipped.** It works across several domains or systems. The repository, the shell and the code host. [Source](https://code.claude.com/docs/en/claude-code-on-the-web) (documented)
- **As shipped.** It connects to external tools or services across a trust boundary. Sessions reach package registries and other allowlisted domains. [Source](https://code.claude.com/docs/en/cloud-environments) (documented)

### Does it work with other agents?

- **Available, if the operator turns it on.** Several agents coordinate inside the organisation. Agent teams, as in the local product: experimental and disabled by default. [Source](https://code.claude.com/docs/en/agent-teams) (documented)
- *Not evidenced.* Agents operate across organisational boundaries or disparate stacks.
- *Not evidenced.* There is a published protocol or communication layer between agents.

### What is the person's role?

- *Not evidenced.* The person operates: every action is prompted and controlled by them.
- *Not evidenced.* The agent suggests; the person reviews and approves each action.
- *Not evidenced.* The agent handles routine tasks; the person is consulted on exceptions.
- **As shipped.** The agent works independently; the person approves critical decisions only. The person starts a task and reviews the branch or pull request it produces. [Source](https://code.claude.com/docs/en/claude-code-on-the-web) (documented)
- *Not evidenced.* The agent has full autonomy within boundaries; the person monitors.

### Is what it is for written down?

- **As shipped.** Its purpose and permitted tasks are stated in writing. The vendor states what cloud sessions are for. [Source](https://code.claude.com/docs/en/claude-code-on-the-web) (documented)
- **Available, if the operator turns it on.** Its autonomy limits and the tools it may use are defined. A cloud environment sets network access, variables and a setup script. [Source](https://code.claude.com/docs/en/cloud-environments) (documented)
- *Not evidenced.* Its limits and known failure cases are documented for those who use it.

### Does it have its own identity and only the access it needs?

- **Claimed, not counted.** What it can reach is enumerated: scopes, permissions, tools. A published deployment shape lists 15 capabilities, 13 of them observed on the thing itself. [Source](https://abp.sgit.ai/data/profiles/anthropic/claude-code-remote/ccr-container.json) (documented; this fact has to be observed or measured to count)
- *Not evidenced.* Its authorisation is published as metadata that anyone can read.
- **As shipped.** It asks for narrower access than the whole account. GitHub credentials never enter the session’s machine; a proxy attaches them on the server. [Source](https://code.claude.com/docs/en/claude-code-on-the-web) (documented)
- *Not evidenced.* It has its own identity, separate from any person's.
- *Not evidenced.* Its identity is cryptographic and can be checked by others.
- **Claimed, not counted.** Its tokens are bound to the service they were issued for and are not passed on. A stored key is added by the proxy after a request leaves the session, for the hosts listed. [Source](https://code.claude.com/docs/en/cloud-environments) (documented; this fact has to be observed or measured to count)

### Is it in a registry, with an owner?

- *Not evidenced.* The organisation keeps a registry of its agents.
- *Not evidenced.* Each agent has a named owner.
- *Not evidenced.* Agents are retired by a defined process.

### Who is accountable for it?

- *Not evidenced.* A named executive or body is accountable for the organisation's agents.
- *Not evidenced.* Roles and responsibilities for AI risk are documented.

### Is there a policy that governs it?

- *Not evidenced.* A governance policy for agents is published.
- *Not evidenced.* Agents and use cases are classed by risk.
- *Not evidenced.* The laws that apply to it are identified.
- *Not evidenced.* New agents pass an approval or review before they run.

### Can a person step in or stop it?

- **As shipped.** High-impact actions need a person's approval. Work arrives as a branch for a person to review. [Source](https://code.claude.com/docs/en/claude-code-on-the-web) (documented)
- *Not evidenced.* There is a way to pause or stop it.
- *Not evidenced.* There is a defined escalation path.

### Is what it does logged?

- *Not evidenced.* Its actions are logged.
- *Not evidenced.* The log is tamper-evident and kept for a stated time.

### Is it watched while it runs?

- *Not evidenced.* It is monitored in operation.
- *Not evidenced.* Anomalies are detected in real time and raise alerts.

### What stands between it and what it should not do?

- **Claimed, not counted.** A limit on it is enforced by something outside its own reach. With the default (Trusted) network access, sessions reach allowlisted domains "and nothing else through the session’s network". [Source](https://code.claude.com/docs/en/cloud-environments) (documented; this fact has to be observed or measured to count)
- **As shipped.** A limit on it is a setting that its own account could change. Two capabilities in the published shape are limited by a setting. [Source](https://abp.sgit.ai/data/profiles/anthropic/claude-code-remote/ccr-container.json) (documented)
- *Not evidenced.* A limit on it is a rule in prose.
- *Not evidenced.* Policy is enforced as machine-readable rules.
- *Not evidenced.* The difference between what it can reach and what it is for is stated.

### Is it tested, and are the results shown?

- *Not evidenced.* Test or evaluation results are published.
- *Not evidenced.* It is tested for safety and security, including by attack.
- *Not evidenced.* People who did not build it take part in assessing it.

### What happens when it goes wrong?

- *Not evidenced.* There is an incident process for agents.
- *Not evidenced.* Incidents and errors are communicated to those affected.
- *Not evidenced.* There is a plan for a failure of a third party it depends on.

### Do people know it is an AI, and can they answer back?

- *Not evidenced.* It tells the people it talks to that it is an AI.
- *Not evidenced.* There is a channel to report problems with it or contest its output.

### What data does it use, and under what rules?

- *Not evidenced.* The data it uses is described.
- *Not evidenced.* There are data quality rules for what it reads.
- *Not evidenced.* Its privacy risk has been examined.

### What does it depend on from others?

- **As shipped.** The models and third-party components it uses are listed. The product and its model family are named. [Source](https://code.claude.com/docs/en/overview) (documented)
- *Not evidenced.* Third-party components are monitored and have risk controls.

### Has anyone independent checked?

- **As shipped.** A public certificate or audit report covers it. The vendor points to a SOC 2 Type 2 report and an ISO 27001 certificate at its trust centre; they cover the vendor, not a user’s deployment. [Source](https://code.claude.com/docs/en/security) (documented)
- *Not evidenced.* Compliance evidence is produced continuously, ready for a regulator.

### Is the organisation behind it ready?

- *Not evidenced.* There is a stated strategy for agents.
- *Not evidenced.* The people who work with it are trained.
- *Not evidenced.* Its value is measured.
- *Not evidenced.* It is improved on a regular cycle.
- *Not evidenced.* The organisation's risk management covers agents.

## The vault

This rating, its evidence list, its grant and the questions it was made against are kept in a public sgit vault (`kq47p50t`, published 2026-11-10). Anyone can read it with this key:

`sgit_public_read_8996af6ecc712b76dfb7a34f4b820d2e89d066ade22bf910e02b7a5ea39d9fdc:kq47p50t`

With [sgit](https://sgit.ai/): `sgit clone sgit_public_read_8996af6ecc712b76dfb7a34f4b820d2e89d066ade22bf910e02b7a5ea39d9fdc:kq47p50t`. The key reads; it cannot write. An operator who wants to add what only they hold forks the vault into a private one.