Routine Network Access Tiers

Security model for Claude Code cloud routines, controlling which external services a running routine can call.

Tiers

Tier Scope Risk Default?
Trusted Anthropic-vetted domain allowlist (Google, GitHub, Anthropic services) Low Yes
Full Any outbound URL Higher (prompt injection risk) No
Custom User-specified domain list Configurable No

Key points

  • Default is Trusted — sufficient for GitHub repo operations, Google services, and Anthropic APIs [src-010]
  • Full network access required for third-party services not on Anthropic's allowlist (e.g., Alpaca Markets, Perplexity API) [src-010]
  • Full mode increases prompt injection risk: a malicious web response could instruct the agent to take unintended actions [src-010]
  • Custom tier lets teams specify an exact allowlist — best practice for production routines with defined external dependencies [src-010]

Related concepts

Source references

  • [src-010] Nate Herk — Cloud agents & model releases cluster (2026-04-14 to 2026-04-17)

Robin Cartier perspective

This page is part of Robin Cartier's working AI knowledge graph: a practical research layer for production AI, recommendation systems, experimentation, GEO, and agentic web readiness.

The useful next step is to connect this concept back to applied product leadership and operating models.

Recommended next

Keep reading from this thread

From 500 indexed pages and articles.

  1. Wiki concept Claude Code Cloud Routines Cloud-hosted scheduled agent feature in Claude Code. Configure a prompt once; it runs on Anthropic's infrastructure on a cron schedule, via API Related by 010
  2. Wiki concept Autonomous Trading Agents AI agents given market data, brokerage access, strategy instructions, and recurring execution authority to research, trade, rebalance, and review Related by 010
  3. Wiki concept Stateless Agent Memory Pattern Design pattern for agents that run in ephemeral, stateless environments (such as Claude Code cloud routines). Related by 010