Claude SDK for Go 2

Apply the Go 1.27 baseline first. These rules cover applications using github.com/anthropics/anthropic-sdk-go/v2, including Messages, local and remote tools, managed agents, administration, and cloud adapters.

Client identity and request scope

• Construct a separate anthropic.Client for each tenant, workspace, provider, and privilege tier. Keep its options under server control and bind WorkspaceID, UserProfileID, resource IDs, and routing headers to the authenticated principal before every operation.
• Select one intended credential source. DefaultClientOptions checks ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, an explicit profile, environment federation, then an active or default profile; a profile can also supply routing and workspace settings. Reject an unexpected identity or endpoint before sending user data.
• Use option.WithoutEnvironmentDefaults() when process environment, profile files, or ANTHROPIC_CUSTOM_HEADERS are outside the application's trusted configuration. Explicitly remove X-Api-Key with option.WithHeaderDel when a bearer or environment token replaces an API key; adding Authorization does not erase the other header.
• Keep federation rule, organization, expected service account, identity-token source, and workspace in trusted configuration. A new workspace or origin needs its own credential exchange; keep profile and identity-token files outside model-readable directories.
• Restrict option.WithBaseURL, request-level base URL overrides, provider endpoints, and raw Client.Get/Post/Execute paths to approved HTTPS origins.