Anthropic · Chat assistant
Claude.ai
Anthropic's web and desktop assistant — the surface where non-engineers meet AI, and where connector governance matters more than code review.
What you are actually governing
Claude.ai is the surface with the broadest internal audience and the least technical one. The people using it are in legal, finance, sales and support, not just engineering, and the material they bring to it is contracts, pipeline data, board material and customer correspondence. That inverts the usual risk model: the danger is less that someone runs malicious code and more that sensitive material meets an unreviewed integration.
Connectors are the governance centre of gravity. Claude.ai can connect to external systems over MCP, which means a business user can grant an assistant access to a document store or a ticketing system through an OAuth consent screen — a genuine privilege grant that looks like clicking Allow. Enterprise plans provide admin controls over which connectors are available, and using them is the difference between a governed integration surface and an unmanaged one.
Projects add a second, quieter surface. Project knowledge is uploaded content that persists and is loaded into every conversation in that project, and custom instructions are standing directions to the model. Both are the same category of artifact as a rule file in a repository: they shape behaviour, they are rarely reviewed, and anyone with project access can change them.
The exposure most organisations actually have here is not a malicious connector but the absence of an inventory. Which connectors are enabled, who authorised them, what scopes they hold, and what material sits in project knowledge — those are answerable in principle through admin tooling and almost never answered in practice, because nobody owns the question.
Artifact classes this surface loads
Each of these changes what the agent does, and each arrives through a channel with no dependency review. This is the inventory a governance programme has to cover — not a feature list.
- Connectors (MCP)
- Projects
- Project knowledge
- Skills
- Custom instructions
What Anthropic genuinely controls
Documented controls worth configuring fully before buying anything. Every one is cited to Anthropic's own documentation below.
- Enterprise admin controls
Organisation-level administration over members, and on enterprise plans over which connectors and capabilities are available to users.
- SSO and directory integration
Identity managed through the organisation's provider rather than through individual accounts, which is the precondition for everything else.
- Connector authorisation
External access is granted through explicit OAuth consent with declared scopes, and can be revoked centrally.
- Data handling commitments
Commercial terms govern retention and training use, which differ materially from consumer plans.
What is still open once those are configured
Not criticism of the product — the honest boundary of a per-machine configuration model. These are fleet questions, and local settings were never designed to answer them.
- No connector security assessment
Admin controls decide whether a connector is permitted. They do not tell you whether its tool definitions are safe, or alert you when they change.
- Project knowledge is ungoverned content
Uploaded knowledge and custom instructions shape every conversation in a project with no review path and no version history a security team can audit.
- Personal-account usage stays invisible
The strongest admin configuration governs the managed organisation. Work done in a personal account on a personal device is outside it entirely.
- No cross-surface artifact view
A connector approved here is frequently the same MCP server engineering connected to a coding agent. Neither side sees the other.
Frequently asked
- What is the biggest Claude.ai governance gap for most companies?
- Connector inventory. Business users can authorise access to real systems through a consent screen, and most organisations have never enumerated which connectors are enabled, with which scopes, authorised by whom.
- Is project knowledge a security concern?
- It is the same concern as any always-loaded instruction file. Content in project knowledge shapes every conversation in that project, is editable by anyone with project access, and typically has no review or version history.
- Do enterprise plan controls stop shadow AI?
- They govern the managed organisation, which is necessary and not sufficient. Usage on personal accounts and personal devices sits outside any admin console, which is why a sanctioned path has to be genuinely better than the unsanctioned one.
Sources
Compiled from Anthropic's own documentation on 2026-07-25. Products in this category change quickly — verify against the source before a decision depends on a specific mechanism.