I ran into an interesting analysis of two hypothetical shapes an enterprise product like Claude could take, and the split maps exactly to a security principle we already know. The first shape, call it "Claude Cowork", is the general assistant: connected to email, Slack, and Google Drive. It sees everything and knows everything, and it is also a huge attack surface. The second, "Claude Code", is a dedicated developer tool: isolated, sandboxed, with access to the codebase and the terminal only. Much safer, much less flexible.
Why is this just least privilege again?
As an architect, this division is the most sensible thing in the world. It is the principle of least privilege, applied to AI assistants. I really do not want the bot that read the email thread about the office party to be able to run apply on a production Kubernetes configuration.
The assistant that summarizes your inbox should not hold the keys to production. That is not a product question, it is a security principle.
Will organizations actually go for it?
That is the real question. The temptation of an all-in-one tool that stitches everything together is enormous. It is easier to buy and, on paper, easier to manage. Nobody loves working with a fragmented toolset.
It also creates internal friction. Developers will prefer the general tool because it has more context; summarizing a PR discussion straight from Slack is genuinely useful. Security teams will obviously prefer the locked-down version. It is the familiar battle between convenience and security, playing out one more time.
Where is this heading?
My bet is that we will see this split happen not just with Claude but with Copilot and every other enterprise assistant. Least privilege won everywhere else in security, and the first serious incident involving an over-connected assistant will settle the argument quickly.
If you are planning an AI rollout and trying to decide where the boundaries between assistants should sit, this is exactly the kind of architecture question I work through with clients in enterprise AI engagements. Isolated, specialized agents or the all-powerful assistant: which one wins in your organization says a lot about who is in the room when the decision is made.
FAQ
What does least privilege mean for AI assistants?
The same thing it means everywhere else in security: every agent gets access only to what its job requires. A coding agent gets the codebase and a terminal in a sandbox. A general work assistant gets email and documents but no production systems. No single assistant should hold every permission at once.
Will enterprises actually adopt isolated AI agents?
The pull toward one all-in-one tool is strong because it is easier to buy and easier to manage on paper. My bet is that security teams will force the split anyway, the same way least privilege won everywhere else, and we will see it across Claude, Copilot, and the other vendors.