Claude's Compliance API hits GA: agent sessions are records

Anthropic moved the Compliance API session endpoints out of beta today. If your team runs Claude Code or Cowork, the transcripts of those sessions — including the ones running on employee laptops — are now a stable, documented API call away. That is a governance feature, and it is also a warning about how you should be treating every other AI tool in your stack.

What actually happened

Per the Claude Platform release notes, the Compliance API session endpoints are now generally available for Cowork and Claude Code sessions. The beta ran fast: remote Cowork sessions on August 3, local sessions on your users' machines on August 11, GA on August 26. Three weeks from preview to production surface.

Two things shipped alongside it. The local session endpoints now also return transcripts of Claude Science sessions and Claude for Microsoft 365 sessions in Excel, PowerPoint, Word, and Outlook — still in beta, for Claude Enterprise organizations, using an existing Compliance Access Key with the read:compliance_user_data scope. And the Admin API is now callable from the ant CLI and the Python, TypeScript, C#, Go, Java, PHP, and Ruby SDKs under client.beta.organization, covering members, invites, workspaces, API keys, rate limits, service accounts, federation rules, and customer-managed encryption keys. Usage and cost reports stay curl-only for now.

Read the surface plainly: session listing, session metadata, session messages. GET /v1/compliance/apps/sessions/local, then the transcript.

Why AI compliance logs matter for your business

Most small companies adopted AI tools the way they adopted Dropbox — one person, then a team, then everyone, and no one wrote down what it touches. The transcript question shows up later, and it always shows up in a bad week: a client asks what data went into the model, an ex-employee's work needs reconstructing, or a bug gets traced back to something an agent did at 11pm with no reviewer.

An AI session is a business record now. Treat it like one. That means deciding three things before you need them: who can pull transcripts, how long you keep them, and what happens when a customer asks you to produce or delete one. A compliance key with an org-wide read scope is a real key — put it in the same drawer as your production database credentials, not in a shared doc.

The larger point is portability. Anthropic built this pipe. Your other vendors may not have, and the ones that have not are the risk. Inventory every AI tool your team touches, and for each one answer: can we export the session history, and in what format? Where the answer is no, either route that work through a tool that can, or wrap it in your own logging layer. We build the wrapper often enough that it has a shape — a thin proxy, structured events to your own store, retention you control.

Sources: Claude Platform release notes, Compliance API sessions documentation.