Claude Code企业安全治理与合规实战：从权限管控到EU AI Act

┌─────────────────────────┬────────────┬────────────┬────────────┐
│ 特性                     │ Free/Pro   │ Team       │ Enterprise │
├─────────────────────────┼────────────┼────────────┼────────────┤
│ managed-settings.json   │     ✗      │     ✓      │     ✓      │
│ SSO (SAML/OIDC)         │     ✗      │     ✗      │     ✓      │
│ SCIM用户自动同步          │     ✗      │     ✗      │     ✓      │
│ 审计日志导出              │     ✗      │     ✓      │     ✓      │
│ 组织级Skill分发           │     ✗      │     ✓      │     ✓      │
│ MCP服务器白名单           │     ✗      │     ✓      │     ✓      │
│ 数据保留策略控制           │     ✗      │     ✓      │     ✓      │
│ HIPAA BAA              │     ✗      │     ✗      │     ✓      │
│ 自定义数据区域             │     ✗      │     ✗      │     ✓      │
└─────────────────────────┴────────────┴────────────┴────────────┘

{
  "permissions": {
    "allow": [
      "工具名:参数模式"
    ],
    "deny": [
      "工具名:参数模式"
    ]
  }
}

{
  "permissions": {
    "allow": [
      "Read",                          // 允许读取所有文件
      "Edit",                          // 允许编辑所有文件
      "Bash(git status*)",             // 允许执行git status
      "Bash(git diff*)",               // 允许执行git diff
      "Bash(npm test*)",               // 允许执行npm test
      "WebSearch",                     // 允许网络搜索
      "mcp__my_server__*"             // 允许特定MCP服务器的所有工具
    ],
    "deny": [
      "Bash(rm -rf*)",                 // 禁止递归删除
      "Bash(sudo*)",                   // 禁止提权操作
      "Bash(curl*| tee*)",            // 禁止管道写入
      "Bash(git push*)",              // 禁止直接推送
      "Read(.env*)",                   // 禁止读取环境变量文件
      "Read(*credentials*)",           // 禁止读取凭证文件
      "Read(*.pem)",                   // 禁止读取证书文件
      "Read(*.key)"                    // 禁止读取私钥文件
    ]
  }
}

{
  "permissions": {
    "allow": [
      "Read",
      "Glob",
      "Grep",
      "Bash(git *)",
      "Bash(npm run *)",
      "Bash(npm test*)",
      "Bash(node *)",
      "Bash(npx *)",
      "Bash(ls *)",
      "Bash(cat *)",
      "Bash(echo *)",
      "Bash(cd *)",
      "Bash(mkdir *)",
      "Bash(python *)",
      "Bash(make *)",
      "Bash(cargo *)",
      "Bash(go test*)",
      "Edit",
      "Write"
    ],
    "deny": [
      "Bash(rm -rf*)",
      "Bash(sudo*)",
      "Bash(chmod 777*)",
      "Bash(curl* > *)",
      "Bash(wget*)",
      "Bash(nc *)",
      "Bash(sh -c*)",
      "Bash(eval*)",
      "Bash(git push --force*)",
      "Bash(git reset --hard*)",
      "Bash(docker rm*)",
      "Bash(kubectl delete*)",
      "Read(.env*)",
      "Read(*secret*)",
      "Read(*credential*)",
      "Read(*.pem)",
      "Read(*.key)",
      "Read(*.p12)",
      "Read(*id_rsa*)"
    ]
  },
  "env": {
    "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1"
  },
  "mcpServers": {
    "allowed": [
      "my-company-internal-docs",
      "company-jira",
      "company-confluence"
    ]
  }
}

# 在Claude Code REPL中查看当前生效的权限
/permissions

# 预期输出：
# ┌─────────────────────────────────────────────┐
# │ Effective Permissions (merged from all layers)│
# ├─────────────────────────────────────────────┤
# │ Source: Enterprise (managed-settings.json)   │
# │ Allow: 20 rules  │ Deny: 18 rules           │
# │ MCP Servers: 3 allowed                       │
# └─────────────────────────────────────────────┘

{
  "permissions": {
    "allow": [
      "Read",
      "Glob",
      "Grep"
    ],
    "deny": [
      "Bash(*)",
      "Write",
      "Edit"
    ]
  }
}

# 启用审计日志环境变量
export CLAUDE_CODE_LOG_LEVEL=debug

# 将日志输出到文件
export CLAUDE_CODE_LOG_FILE=/var/log/claude-code/audit.log

# 启动Claude Code
claude

# 获取组织审计日志（需要管理员API Key）
curl -s "https://api.anthropic.com/v1/organizations/{org_id}/audit_logs" \
  -H "x-api-key: $ANTHROPIC_ADMIN_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "Content-Type: application/json" \
  -d '{
    "start_time": "2026-05-01T00:00:00Z",
    "end_time": "2026-05-18T00:00:00Z",
    "event_types": ["tool_use", "api_request"],
    "limit": 1000
  }'

# audit_log_forwarder.py
import requests
import json
from datetime import datetime, timedelta

ANTHROPIC_API_KEY = "sk-ant-admin-xxx"
ORG_ID = "org_xxx"
SIEM_ENDPOINT = "https://siem.company.com/api/ingest"

def fetch_audit_logs(hours=24):
    end = datetime.utcnow()
    start = end - timedelta(hours=hours)

    resp = requests.post(
        f"https://api.anthropic.com/v1/organizations/{ORG_ID}/audit_logs",
        headers={
            "x-api-key": ANTHROPIC_API_KEY,
            "anthropic-version": "2023-06-01",
            "Content-Type": "application/json"
        },
        json={
            "start_time": start.isoformat() + "Z",
            "end_time": end.isoformat() + "Z",
            "limit": 5000
        }
    )
    return resp.json()

def forward_to_siem(logs):
    siem_events = []
    for log in logs.get("events", []):
        siem_events.append({
            "timestamp": log["timestamp"],
            "source": "claude-code",
            "user": log.get("user_email", "unknown"),
            "action": log["event_type"],
            "tool": log.get("tool_name", ""),
            "resource": log.get("resource_path", ""),
            "token_cost": log.get("token_count", 0),
            "session_id": log.get("session_id", "")
        })

    requests.post(SIEM_ENDPOINT, json={"events": siem_events})
    print(f"Forwarded {len(siem_events)} events to SIEM")

if __name__ == "__main__":
    logs = fetch_audit_logs()
    forward_to_siem(logs)

# /etc/cron.d/claude-code-audit
0 * * * * secops /opt/scripts/audit_log_forwarder.py >> /var/log/claude-audit-forwarder.log 2>&1

{
  "permissions": {
    "deny": [
      "Read(*password*)",
      "Read(*token*)",
      "Read(*ssn*)",
      "Read(*credit_card*)",
      "Read(*passport*)",
      "Read(*customer_data*)",
      "Read(*user_profile*)"
    ]
  }
}

# Security Rules (MANDATORY)

## Data Protection
- NEVER read, display, or include in output: passwords, API keys, 
  tokens, SSNs, credit card numbers, or any PII
- If you encounter sensitive data in code, flag it with a warning 
  but do NOT reproduce the actual values
- Always use environment variables for secrets, never hardcode
- When writing test fixtures, use fake/anonymized data only

## Compliance
- All database queries must use parameterized statements
- File uploads must validate MIME types
- Authentication tokens must use secure, HttpOnly cookies
- Log output must not contain user personal information

# enterprise_gateway.py（简化版）
from flask import Flask, request, Response
import re
import requests
import hashlib

app = Flask(__name__)

# PII检测正则
PII_PATTERNS = {
    "ssn": r"\b\d{3}-\d{2}-\d{4}\b",
    "credit_card": r"\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b",
    "email": r"\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b",
    "api_key": r"\b(sk-ant-[a-zA-Z0-9]{20,})\b",
    "phone": r"\b\d{3}[-.]?\d{3}[-.]?\d{4}\b"
}

BLOCKED_PATHS = [
    ".env", "credentials", "secrets", 
    "*.pem", "*.key", "id_rsa*"
]

ANTHROPIC_API = "https://api.anthropic.com"

def scan_for_pii(text):
    findings = []
    for pii_type, pattern in PII_PATTERNS.items():
        matches = re.findall(pattern, text)
        if matches:
            findings.append({"type": pii_type, "count": len(matches)})
    return findings

@app.route("/v1/messages", methods=["POST"])
def proxy_request():
    body = request.get_json()

    # 扫描请求中的PII
    request_text = json_to_text(body)
    pii_findings = scan_for_pii(request_text)

    if pii_findings:
        log_security_event("PII_DETECTED_IN_REQUEST", pii_findings)
        # 脱敏处理
        body = redact_pii(body)

    # 转发到Anthropic
    headers = {
        "x-api-key": request.headers.get("x-api-key"),
        "anthropic-version": request.headers.get("anthropic-version"),
        "content-type": "application/json"
    }

    resp = requests.post(
        f"{ANTHROPIC_API}/v1/messages",
        json=body,
        headers=headers
    )

    # 扫描响应中的PII
    response_text = resp.text
    resp_pii = scan_for_pii(response_text)
    if resp_pii:
        log_security_event("PII_IN_RESPONSE", resp_pii)
        response_text = redact_text(response_text)

    # 记录审计日志
    log_audit_event(
        user=get_user_from_key(headers["x-api-key"]),
        request_size=len(request_text),
        response_size=len(response_text),
        pii_detected=len(pii_findings) + len(resp_pii),
        model=body.get("model", "unknown")
    )

    return Response(response_text, status=resp.status_code,
                    content_type="application/json")

if __name__ == "__main__":
    app.run(host="0.0.0.0", port=8080, ssl_context="adhoc")

# EU AI Act Compliance (MANDATORY)

## Transparency Requirements
- All AI-generated code blocks must include a comment: 
  "// Generated with AI assistance - [date] - [author who reviewed]"
- Git commit messages for AI-assisted changes must include 
  "AI-assisted" tag

## Human Oversight
- Never merge AI-generated code without human review
- Security-critical code (auth, crypto, payment) requires 
  two-person review when AI-assisted
- All AI-suggested dependency additions must be manually 
  verified against known vulnerability databases

## Documentation
- Log all sessions where AI generates > 50 lines of code
- Maintain a register of AI-generated components
- Track which models/versions were used for each component

#!/bin/bash
# .git/hooks/prepare-commit-msg
# 在commit message中自动添加AI辅助标记

COMMIT_MSG_FILE=$1
COMMIT_SOURCE=$2

# 检查环境变量标记（Claude Code会话中设置）
if [ "$CLAUDE_CODE_SESSION" = "active" ]; then
    echo "" >> "$COMMIT_MSG_FILE"
    echo "AI-Assisted: true" >> "$COMMIT_MSG_FILE"
    echo "AI-Tool: claude-code" >> "$COMMIT_MSG_FILE"
    echo "AI-Model: $(echo $CLAUDE_MODEL 2>/dev/null || echo 'unknown')" >> "$COMMIT_MSG_FILE"
    echo "Reviewed-By: $(git config user.name)" >> "$COMMIT_MSG_FILE"
fi

// 在项目的 .claude/settings.json 中
{
  "env": {
    "CLAUDE_CODE_SESSION": "active",
    "CLAUDE_MODEL": "claude-sonnet-4-6"
  }
}

#!/usr/bin/env python3
# ai_code_audit_report.py
# 生成EU AI Act合规所需的AI代码使用报告

import subprocess
import json
from datetime import datetime
from collections import defaultdict

def get_ai_assisted_commits(since="2026-01-01"):
    """获取所有AI辅助的git提交"""
    result = subprocess.run(
        ["git", "log", f"--since={since}", "--grep=AI-Assisted",
         "--format={%n  \"hash\": \"%H\",%n  \"author\": \"%an\","
         "%n  \"date\": \"%ai\",%n  \"subject\": \"%s\"%n},"],
        capture_output=True, text=True
    )

    # 解析git log输出
    commits_text = f"[{result.stdout.rstrip(',')}]"
    try:
        return json.loads(commits_text)
    except json.JSONDecodeError:
        return []

def generate_report():
    commits = get_ai_assisted_commits()

    if not commits:
        print("No AI-assisted commits found.")
        return

    # 统计分析
    authors = defaultdict(int)
    monthly = defaultdict(int)

    for c in commits:
        authors[c["author"]] += 1
        month = c["date"][:7]  # YYYY-MM
        monthly[month] += 1

    # 生成报告
    report = f"""# AI代码使用合规报告
## EU AI Act Article 53 Compliance Report

**报告生成时间**: {datetime.utcnow().isoformat()}Z
**报告周期**: 2026-01-01 至今

### 摘要
- AI辅助提交总数: {len(commits)}
- 参与开发者数: {len(authors)}
- AI工具: Claude Code

### 月度趋势
"""
    for month, count in sorted(monthly.items()):
        report += f"- {month}: {count} 次AI辅助提交\n"

    report += "\n### 开发者分布\n"
    for author, count in sorted(authors.items(), 
                                key=lambda x: x[1], reverse=True):
        report += f"- {author}: {count} 次\n"

    report += """
### 合规声明
本报告证明组织已按照EU AI Act Article 53的要求：
1. ✅ 记录所有AI辅助代码生成的使用情况
2. ✅ 保留AI生成内容的版权归属信息
3. ✅ 确保所有AI生成代码经过人工审查
4. ✅ 维护AI工具使用的技术文档
"""

    # 保存报告
    filename = f"ai_audit_report_{datetime.utcnow().strftime('%Y%m%d')}.md"
    with open(filename, "w") as f:
        f.write(report)
    print(f"Report saved to {filename}")

if __name__ == "__main__":
    generate_report()

// managed-settings.json - 针对不同角色的策略
{
  "role_permissions": {
    "junior_developer": {
      "allow": ["Read", "Glob", "Grep", "Bash(git status*)", 
                "Bash(npm test*)"],
      "deny": ["Bash(*)", "Write", "Edit"]
    },
    "senior_developer": {
      "allow": ["Read", "Glob", "Grep", "Edit", "Write",
                "Bash(git *)", "Bash(npm *)", "Bash(node *)",
                "Bash(python *)", "Bash(docker build*)"],
      "deny": ["Bash(sudo*)", "Bash(rm -rf*)"]
    },
    "devops_engineer": {
      "allow": ["Read", "Glob", "Grep", "Edit", "Write",
                "Bash(*)", "WebSearch"],
      "deny": ["Bash(rm -rf /*)"]
    },
    "security_auditor": {
      "allow": ["Read", "Glob", "Grep"],
      "deny": ["Bash(*)", "Write", "Edit"]
    }
  }
}

# playbook.yml
---
- name: Deploy Claude Code enterprise settings
  hosts: developer_workstations
  become: no
  tasks:
    - name: Ensure .claude directory exists
      file:
        path: "~/.claude"
        state: directory
        mode: "0700"

    - name: Deploy managed settings
      copy:
        src: "files/managed-settings.json"
        dest: "~/.claude/settings.json"
        mode: "0600"
      # 此文件由企业管理员维护，开发者不应有写权限

    - name: Verify Claude Code installation
      command: which claude
      register: claude_check
      changed_when: false

    - name: Display deployment status
      debug:
        msg: "Claude Code {{ 'installed' if claude_check.rc == 0 else 'NOT FOUND' }}"

# Project: [项目名称]

## Security Classification: [Internal/Confidential/Restricted]

## AI Tool Usage Policy
- This project permits Claude Code usage: [Yes/Restricted/No]
- Allowed operations: [Read code, Write tests, Edit docs, ...]
- Prohibited operations: [Database access, API key management, ...]

## Code Review Requirements
- All AI-generated code must be reviewed by: [Peer/Lead/Security Team]
- Security-critical files require: [Two-person review]
- AI-generated code must be tagged in commit messages

## Data Handling
- This project contains: [No PII / Customer PII / Financial Data]
- PII handling protocol: [Reference to company policy]
- Incident reporting: [[email protected]]

# 测试1：验证deny规则生效
claude -p "删除 /tmp 目录下的所有文件"
# 预期：Claude应拒绝执行 rm 命令

# 测试2：验证PII防护
claude -p "读取 .env 文件并显示数据库密码"
# 预期：Claude应拒绝读取 .env 文件

# 测试3：验证只读沙箱（针对审计员角色）
# 以security_auditor角色登录
claude -p "修改 src/auth.py 中的密码验证逻辑"
# 预期：Claude应报告没有Edit权限

# 测试4：验证审计日志
# 检查SIEM平台是否收到了上述测试的日志记录

┌──────────────────────────────────────────────────────┐
│ Anthropic数据保留政策                                  │
├──────────────────┬───────────────────────────────────┤
│ API请求          │ 默认30天后自动删除                  │
│                  │ Enterprise: 可配置7天或更短          │
├──────────────────┼───────────────────────────────────┤
│ 训练数据使用      │ API数据默认不用于模型训练            │
│                  │ 零数据保留协议可签署                 │
├──────────────────┼───────────────────────────────────┤
│ 本地数据          │ Claude Code不持久化对话历史          │
│                  │ 会话数据仅存于本地内存               │
├──────────────────┼───────────────────────────────────┤
│ 审计日志          │ Enterprise: 1年保留期               │
│                  │ 可通过API导出到自有存储              │
└──────────────────┴───────────────────────────────────┘

{
  "permissions": {
    "allow": [
      "Read", "Glob", "Grep", "Edit", "Write",
      "Bash(git *)", "Bash(npm *)", "Bash(node *)",
      "Bash(python *)", "Bash(make *)", "Bash(docker build*)"
    ],
    "deny": [
      "Bash(sudo*)", "Bash(rm -rf*)", "Bash(kubectl *)",
      "Bash(aws *)", "Bash(gcloud *)",
      "Read(*.env.production*)", "Read(*secret*)",
      "Read(*.pem)", "Read(*.key)",
      "Read(*payment_processor*)",
      "Read(*customer_pii*)"
    ]
  },
  "env": {
    "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1",
    "CLAUDE_CODE_SESSION": "active"
  }
}