How it works
Attribution and the activity log
Claude does not get an account of its own. It works under yours, and each policy’s activity log says so — which is what makes a mistake findable and fixable.
Claude has no account of its own#
There is no service account, no integration user and no API key belonging to Claude. A call through the connector runs under your session, built fresh from the membership table on every request, with one difference: the name it carries has via Claude appended. Everything that prints a name — the policy’s activity log, a notification to a colleague, the “by” on a generated document — prints that.
It is the same mechanism Bird uses inside Brella OS, where the suffix is via Bird. Nothing else about the session changes: not the role, not the org, not what the handlers will let it do.
What a morning looks like#
A morning on the demo book. Every row is a change; the one that is marked asks first happened only after a person allowed it.
Activity · Harborview Insurance
This morning
09:41
ChangesWrote construction, building area, year built and fire protection to the main building
Magnolia Kitchen & Oyster Bar
update_building
ChangesMaren Holt via Claude
09:42
ChangesWrote roof last updated: 2018
Magnolia Kitchen & Oyster Bar
update_building
ChangesMaren Holt via Claude
09:42
Asks firstGenerated ACORD 125, 126, 140 and the Schedule of Values, after you allowed it
Magnolia Kitchen & Oyster Bar
generate_acords
Asks firstMaren Holt via Claude
09:47
Asks firstIssued a certificate to Greenway Property Management LLC, after you allowed it
Bayou City Apartments LLC
issue_certificate
Asks firstMaren Holt via Claude
09:52
ChangesRecorded that hired & non-owned auto was declined, by phone
Magnolia Kitchen & Oyster Bar
record_advisory
ChangesMaren Holt via Claude
An illustrative morning on the demo book. Names and policies are fictional; the columns are the ones the workspace actually records.
Which app gets named#
The app in the “by” column is not a name an app chose for itself. A client identified by a metadata document is self-asserted, so only hosts we recognise — claude.ai and claude.com — are printed as simply “Claude”. Any other client’s name travels with its host, as Acme (acme.example), which means an app that calls itself Claude from somewhere else cannot pass for Claude on your activity log. The consent page leads with the host for the same reason.
Reads leave nothing behind#
Reading changes nothing, so it writes nothing: opening a policy through Claude does not appear on that policy’s activity log, exactly as opening it on screen does not. What Brella records about a connection — which action ran, for whom, and whether it succeeded — is on data handling, and it is server logging, not a second activity feed.
What this is for
If Claude does something you did not intend, the change is on the policy with your name and the tool that made it, so you can see what changed and put it right. Anything outward or permanent asked you first. And the connection can be revoked in a tap.
The four rules of a connection#
It sees what you see.
An Owner or Manager, the agency’s book; a User, only the policies assigned to them. Checked on every request — leave the agency and the connection stops.
An hour at a time.
Access lasts an hour and renews while you use it. An unused connection lapses after 30 days, and every connection asks you again after 180.
Off whenever you say.
Brella OS → Settings → Claude. An Owner can disconnect any connection into the workspace; it stops on the next request.
A password reset ends it.
Reset your Brella OS password and every connection you hold is disconnected.
Where to see it#
- On the policy. Its activity log lists every change, newest first, with the tool and the person. Claude can read it too —
get_policy_activity. - In Settings → Claude. Every connection into your workspace: who, which app, which permissions, when it was last used. An Owner sees the agency’s; everyone sees their own.
- In the defence file. A policy’s E&O defence file assembles the advisory record, stage history, certificates, changes, claims, documents and the chat log into one dated PDF — attribution included, generated on demand and never stored.