Anthropic EFS: balancing privacy and agent monitoring
Anthropic has announced Enterprise Frontier Safeguards, an architecture that tries to resolve a very practical tension for regulated enterprises: detecting dangerous use of more agentic models without requiring the provider to directly hold sensitive logs.
1. What Anthropic announced
On September 1, 2026, Anthropic introduced Enterprise Frontier Safeguards, or EFS, as a solution combining zero data retention privacy with misuse-detection safeguards. The announced principle is that activity data used for monitoring can remain in cloud infrastructure controlled by the customer, such as Amazon S3, Azure Blob Storage, or Google Cloud Storage, under the customer's encryption keys, access policies, and audit logs.
Anthropic says the rollout will start in phases later this fall. EFS is expected to be supported with Claude Code, Claude Enterprise, the Claude Platform, Amazon Bedrock, Claude Platform on AWS, Google's Agent Platform, and Microsoft Foundry. Customer-controlled storage, customer-managed keys, and automated review are described as opt-in options.
2. The problem: monitoring without creating another data vendor
The challenge is familiar to CIOs, CISOs, and compliance teams: models that can use tools, retain context, and execute long-running tasks require monitoring across sessions and accounts. Without time-based correlation, it becomes harder to detect offensive use, credential theft, or agent drift.
But that monitoring collides with regulated-sector constraints: legal privilege, health data, non-public information, customer files, industrial production data, and public-sector obligations. EFS addresses that tension by separating two responsibilities: Anthropic operates automated detection systems, while the enterprise keeps retention and human review within its own boundary.
3. What this changes for Belgian and French companies
For SMEs, the point is not to immediately copy a global bank's architecture. The signal is that zero data retention is no longer enough as a standalone argument when agents can act. Teams need to define who retains traces, for how long, under which keys, with which administrator access, and how an alert becomes a human decision.
For mid-market companies, large enterprises, public administrations, and organizations under sector-specific obligations, this becomes a supplier-selection criterion. Before connecting an agent to document RAG, Odoo, email, code, or business APIs, the company should verify whether logs remain under its control, whether access is auditable, whether signals shared with the provider are limited, and whether the security team can handle alerts without exposing more data than needed.
4. Underside analysis: sovereignty, RAG, Odoo, and agents
Underside's analysis is that this announcement moves the discussion from contractual promises to operable architecture. AI sovereignty is not only about choosing a local or cloud model: it also depends on log custody, key control, agent identity, least privilege, reversibility, and the ability to prove why an action was executed.
In an Odoo Enterprise project, this logic requires separating read access, proposed writes, draft actions, and binding actions. In RAG, it requires tracing which documents were consulted without exposing the entire corpus. In an Apple Enterprise or managed-device context, it points toward combining local processing, MDM policies, controlled connectors, and central logs rather than assuming that on-device use alone protects the organization.
5. Watch points before production
EFS is announced as a phased rollout, not a guarantee already available to every customer and environment. A Belgian or French company should therefore qualify eligibility, effective region, subprocessors, retention period, transmitted metadata, associated cloud costs, incident procedures, and responsibilities between provider, cloud, integrator, and customer.
The most operational point is human review: if the alert lands with the customer, the customer needs a team able to understand an agentic misuse signal, stop an execution, revoke permissions, and document the decision. Without that process, customer-controlled logs remain an archive, not a production control.
Priority: before deploying a frontier agent on sensitive data, write a monitoring sheet: log location, keys, retention period, shared signals, authorized reviewers, stop thresholds, revocation, and compliance evidence.
Frame AI monitoring