A Claude agent for access management

On this process, the agent is configured in the orange zone: it prepares and checks, an owner validates every grant. Only standard requests already pre-approved in your entitlement catalogue can move to the green zone, and privileged access stays in the red zone.

DORA (EU 2022/2554) requires financial entities, outside the simplified regime, to limit physical and logical access to what legitimate and approved functions require (article 9). Its technical standards (Delegated Regulation 2024/1774, article 21) spell out least privilege, segregation of duties, revoking rights without undue delay when someone leaves, and updating access rights at least once a year, every six months for systems that support a critical or important function.

The NIS2 Directive (EU 2022/2555) lists access control policies and, where appropriate, multi-factor authentication among the risk-management measures expected from essential and important entities (article 21), as transposed into each Member State’s law. The agent helps produce the evidence: traced reviews, revoked rights, inventoried privileged accounts.

The agent has its own identity, with rights limited to what its tasks require, and it only executes a change after validation. Each of its actions is logged like an administrator’s, within the LOOP™ governance framework.

Yes. It connects to your directory, your IAM or IGA tool and your ticketing tool through their APIs or MCP connectors, without replacing your identity management foundation.