---
name: project_ai_auth_product_boundary
description: Which ACG products may use Claude subscription OAuth vs must use customer/API-key auth, and why (Anthropic ToS)
metadata:
  type: project
---

Firm product/AI-auth boundary Mike set 2026-06-14, decided by Anthropic's Agent SDK ToS
(third-party products may NOT offer claude.ai login / subscription rate limits without
written approval):

- **ClaudeTools harness (incl. a future web "ClaudeTools 3.0" co-work app)** —
  ALWAYS internal-only, internal users only. May use per-person Claude subscription OAuth
  (`CLAUDE_CODE_OAUTH_TOKEN` via `claude setup-token`). Compliant pattern = each node/workstation
  authenticates with THAT person's own token (Mike's on Mike's boxes, Howard's on his); the hub
  never centralizes one subscription to serve many. Note: as of 2026-06-15 subscription-backed
  Agent SDK usage draws on a separate monthly credit pool (~$100-200 Max), not unlimited — spill
  to API key when exhausted.
- **GuruRMM** — SELLABLE product. AI features must use the CUSTOMER's own dropped-in API key
  (per-tenant `ANTHROPIC_API_KEY`), never ACG's subscription. Build RMM AI auth around BYO-key
  from day one.
- **Backend dev work (e.g. GuruRMM log-analysis dev side)** — always internal.

**Why:** subscription OAuth is fine for internal/own use but ToS-banned for offering to external
users; getting this wrong on a sellable product is a hard compliance line, not grey.
**How to apply:** ClaudeTools 3.0 web design assumes per-person subscription tokens on each node
(internal). Anything customer-facing (GuruRMM) = customer-provided API keys. See
[[feedback_stream_of_thought_design]] for the design-partner posture on this early-stage vision.
