How can you prove that the Claude Agent SDK is operating under strict audit without building a custom logging pipeline?
Many organizations ship the SDK with a hard‑coded service account key or a long‑lived API token, making it impossible to collect compliance evidence. Engineers check the token into source control, and every request to downstream services bypasses any central review. Engineers can spin up dozens of agents in minutes, but the audit team only sees the final outcome of the operation – no who‑did‑what, no command‑level trace, and no guarantee that sensitive fields were protected.
Adopting a non‑human identity model and granting the SDK only the least‑privilege permissions is a necessary first step. The SDK authenticates with an OIDC token that scopes it to read‑only access on a specific database, and the token expires after a short window. Those controls stop a rogue key from being reused indefinitely, yet the request still travels directly to the target service. No point in the network inspects the request, approves it, or records it, and no automatic masking of PII appears in responses.
Enter hoop.dev. It is a Layer 7 gateway that sits between the Claude Agent SDK and the resources it talks to. By proxying every connection, hoop.dev becomes the only place where policy can be enforced. It validates the SDK’s OIDC token, maps the token to a concrete identity, and then applies a suite of guardrails before the request reaches the backend.
Why continuous compliance evidence matters
Regulators and internal auditors increasingly demand proof that every automated action is traceable. For a generative‑AI‑driven workflow, a single stray query can expose customer data or trigger a costly operation. Continuous compliance evidence means that the system records who initiated the call, what parameters were used, and what response was returned – all in real time. When evidence is generated at the gateway, it cannot be altered by the downstream service or the SDK itself.
How hoop.dev generates compliance evidence
When the Claude Agent SDK connects through hoop.dev, the gateway captures the full protocol exchange. hoop.dev records each session, timestamps every command, and stores the log in a secure audit store. The logs include the identity extracted from the OIDC token, the exact query sent to the backend, and the response payload after any inline masking has been applied. Because masking happens before the response is handed back to the SDK, the audit trail never contains raw PII, yet the SDK receives the sanitized data it needs to continue processing.
In addition to logging, hoop.dev can enforce just‑in‑time approvals. If a query matches a high‑risk pattern – for example, a DELETE on a production table – the gateway pauses the request and routes it to a human approver. The approval decision, along with the rationale, becomes part of the compliance evidence set. This workflow removes the need for ad‑hoc manual checks and ensures that every privileged operation is auditable.
All of these capabilities are available without changing the Claude Agent SDK code. The SDK simply points its endpoint to the gateway address, uses its normal client libraries, and receives the same protocol responses it expects. The gateway handles credential storage, so the SDK never sees the underlying service account key. This separation of duties satisfies the principle of least privilege while delivering a complete audit trail.
Getting started is straightforward. Follow the getting started guide to deploy the gateway in your environment, register the Claude service as a connection, and bind the appropriate OIDC provider. The feature documentation provides deeper details on configuring inline masking, approval policies, and session replay.
FAQ
- Do I need to modify my Claude Agent SDK code to get compliance evidence? No. The SDK only needs to target the gateway endpoint. All logging, masking, and approval logic runs inside hoop.dev.
- What types of evidence does hoop.dev produce? hoop.dev creates a per‑session audit record that includes the authenticated identity, the exact request payload, any masked fields, and the final response. Approval decisions and timestamps are also captured.
- Can the evidence be used for audit and regulatory reporting? Yes. Because the audit trail is generated at the gateway and stored securely, it satisfies most audit‑ready requirements for continuous compliance evidence.
Explore the open‑source repository on GitHub to see the implementation details and contribute improvements: https://github.com/hoophq/hoop.
