An unattended routine has no one to click Deny, so the limits must be set before it runs. Trim connectors to the ones needed, select only the repositories required, choose the narrowest network access, store the API token like a secret, and read the transcript after runs. Each item comes from Anthropic's routines documentation.
1. Trim the connectors
When you create a routine, all of your connected connectors are included by default. The docs say Claude can use every tool from an included connector, including writes, without asking permission during a run. Remove everything the routine does not need.
2. Scope repositories and branches
Each repository you add is cloned on every run, and Claude pushes to branches prefixed with claude/ unless told otherwise. To control which branches a run can push to, the docs point to GitHub branch protection rules or rulesets. Note the caveat they give: for managed runs, those rules apply to the GitHub access you connected, so a rule that your access can bypass will not block a push.
3. Pick the network level on purpose
Each routine uses a cloud environment. The Default environment uses Trusted network access, which allows only a default list of package registries, cloud provider APIs, container registries and common development domains. Blocked requests fail with a 403. You can switch to Custom with your own domains, or Full for unrestricted access. Choose Full only with a reason.
Connector traffic goes through Anthropic's servers rather than that path, so a tight network allowlist does not limit connectors. That is why step 1 matters.
4. Treat the API token as a secret
An API trigger gives a routine its own endpoint and bearer token. The token is shown once and cannot be retrieved later, so store it in your alerting tool's secret store. You can regenerate it or delete it to turn off API access. Environment variables in an Anthropic hosted environment are visible to anyone who uses the environment, so the docs recommend network secrets for API keys.
5. Know what fire text is
Text sent with an API fire or Run now arrives wrapped in a block that labels it as untrusted data and tells Claude not to follow instructions inside it unless the routine's own prompt says to. Write the prompt to reference the payload explicitly, and never assume the payload can authorize anything.
6. Verify the run
A green status means the session started and exited without an infrastructure error. It does not mean the task worked. Open the transcript to see what Claude did.
7. Plan for the owner
Routines belong to your account, and actions through GitHub or connectors appear as you. Team and Enterprise owners can turn routines off for all members.
For broader coding agent guidance, see our Claude Code security practical guide. Safeguard's MCP Guardrail and policy gates are aimed at this kind of agent access, and the free scan is at gold.safeguard.sh/scan.
Click through it at your own pace, or open it full screen.
Quick check
Does a tight network allowlist stop connectors?
No. The docs say connector traffic is routed through Anthropic's servers, so remove unneeded connectors instead.
Sources
Last reviewed: 19 October 2026.
