Governing Claude Enterprise With Twine

Claude, Governed Like Every Other Enterprise App#

Alex, our IAM Digital Employee, brings Claude Enterprise under the same governance as every other enterprise application. Through the Compliance and Admin APIs, Alex inventories members, custom roles, groups, and the connectors each role grants, then enriches every account with identity context from across the enterprise through Twine’s data fabric.

This makes the blind spots visible: accounts provisioned outside SSO, users whose connector access is out of line with peers in the same role, and applications reachable through Claude connectors that were never onboarded into the customer’s IGA platform. Where remediation is warranted, Alex prepares the change and routes it for human approval within Twine before anything is applied, whether that is removing a departed member, adjusting a role, or updating group membership.

The result: Claude Enterprise becomes a governed application rather than an exception, which is what security teams need before they can expand it across the organization.

What Alex Inventories#

• Members. Every account in the org, joined to the identity system of record.
• Custom roles. What each role grants, and which permissions look over-provisioned.
• Groups. Membership and the entitlements that follow from it.
• Connectors. Which applications Claude can reach, including ones IGA never onboarded.

The Problem This Solves#

Accounts Created Outside SSO Survive Termination#

Enterprises expect Claude access to be governed by SSO, but accounts get created outside it through pilots, one-off invites, or direct admin provisioning. Those accounts survive termination, leaving active access to corporate data for people who have left. Today Claude sits outside the access review, so nobody is asking the question.

Alex closes this gap because he already governs the surrounding estate: he holds the identity system of record alongside Claude, so he can tell that an account has no SSO path, or that a Claude connector reaches an application IGA never onboarded. That same position unifies access requests, letting a user request Claude access through the company’s existing ITSM workflow (ServiceNow, for example) while Alex resolves the request and provisions the connector, rather than routing it through a separate process. Neither is possible from inside Claude alone.

How It Works#

Step 1. Anthropic Compliance and Admin APIs. Full directory snapshots of organizations, users, roles, groups and settings, plus the incremental Activity Feed.

Step 2. Alex correlates, reviews, remediates. Accounts are enriched through Twine’s data fabric, findings are raised, and every change waits on human approval in Twine.

Step 3. Enterprise IGA and ITSM. Claude appears in access reviews, and access requests run through the existing ITSM workflow, or through Twine.

Nothing is applied without human approval in Twine.

Connected in Four Steps#

• Create a Compliance API key. A primary owner issues the key for the Claude Enterprise organization.

• Add the key in Twine. The key goes straight into AWS Secrets Manager under your tenant’s KMS key.

• First poll and backfill. Alex takes a full directory snapshot and backfills up to 90 days of activity.
• Turn on reviews and requests. Claude joins your access reviews, and requests route through your existing ITSM workflow.

Integration Guide#

Connecting the Compliance API brings Claude Enterprise into Twine’s data fabric and lets you govern it like any other application.

What the Integration Retrieves#

• All Claude Enterprise members, with their assigned roles and group memberships.
• Connected integrations at the organization level.
• Provisioning source for each account, whether created through IdP/SSO or added manually.
• The ability to update user roles and remove users, subject to approval.

Prerequisites#

• Organization. A Claude Enterprise tenant with the Compliance API enabled at the parent organization.
• Who enables it. The primary owner, via claude.ai then Organization settings then API.
• Credential. Create or use an existing API key with the Compliance scope.

Usage Examples#

Once setup is done, allow up to 24 hours for the data to import. You can then start a new chat with Alex and use the integration to:

• Get all members and their roles and integrations.
• Get roles and groups.
• Ask any question about users, for example who has access to a specific connector.
• Ask who got access to Claude Enterprise by invite or by an admin rather than through IdP/SSO.
• Update user roles, subject to approval.
• Remove a user, subject to approval.
• Create live widgets of any of the above.

Troubleshooting#

The Test Connection Does Not Work#

Check you are entering the correct API key with no trailing space, and that it is the Compliance API key rather than the Admin API key.

No Data Is Available#

Data from Claude Enterprise is harvested once a day at midnight UTC. Allow up to 24 hours after connecting the integration, and for any change made in Claude Enterprise to appear.