Agentic development is the practice of building software with an AI agent. The agent plans and runs multi-step work instead of only answering a single prompt. That work includes reading files, editing code, running commands, and calling other tools. The software that runs the agent's loop is its agentic harness.

An agentic harness is the runtime that drives an AI agent's tool-calling loop. It sends a request to a model, then invokes a tool. A tool can be a file edit, a shell command, or a Model Context Protocol (MCP) server. The harness returns the tool's result to the model. The model then picks the next action.

Claude Code is an agentic harness for software development. It runs on a developer's machine, calling the Anthropic API for inference and calling local and MCP tools on the developer's behalf.

An agentic harness is not the model itself. It's also not a single request-response integration. A harness makes many model calls and many tool calls over the course of one session, often with no human approving each step.

This document covers how F5 Workforce AI Security authenticates an agentic harness for the AI Gateway. It doesn't cover how the gateway classifies or enforces policy on individual tool calls once traffic is routed. See Configure tool policy for agentic harnesses.

An agentic harness like Claude Code authenticates to its model provider by default using a static, long-lived API key. That key sits in a configuration file or an environment variable on the developer's machine.

Routing that traffic through the AI Gateway to a private model instead requires a different credential. The gateway's identity service issues this credential, and the same service can revoke it. No admin distributes or rotates it by hand.

For Claude Code, the Claude Code Helper provides that credential. You install it on each developer's machine. It replaces the static API key with an OAuth 2.0 Device Authorization Grant flow, defined in Request for Comments (RFC) 8628. On first use, the developer completes a one-time login in their browser. The helper caches the resulting access and refresh tokens in the operating system's native credential store, and refreshes them before they expire. Every later Claude Code session authenticates with no repeated login. See Deploy the Claude Code Helper for the installation steps.

The developer machine never holds a static key or a cloud IAM credential, so there's nothing on it to rotate or leak if it's lost or compromised. The organization's identity service is the only place that grants or revokes access.

A platform engineering team wants every developer to use Claude Code against the team's private Bedrock-hosted Claude models. They don't want to ask each developer to request or manage an AWS credential. The team deploys the Claude Code Helper fleet-wide through their mobile device management (MDM) tool. Each developer completes one browser-based login the first time they open Claude Code. Every later session authenticates on its own.

When a developer leaves the team, revoking their identity in the organization's single sign-on (SSO) provider revokes their access to Claude Code's private models. There's no separate AWS credential to track down and delete.

A security team is weighing whether to allow an agentic harness like Claude Code across the organization. Static API keys and per-developer cloud credentials are two of their biggest concerns. Either one can end up copied into a config file, committed to a repository, or left active after a developer offboards.

Centralized OAuth authentication answers both concerns directly. No long-lived secret exists on the developer's machine at all, and the developer's own identity ties back to every session.

For more information, see: