I've been digging into the SDK's session handling for the last week, and I have to say, it leaves me concerned from a compliance standpoint. The abstraction is convenient, but it seems to prioritize developer experience over clear security boundaries.

My main issue is the opacity around credential lifecycle and audit trail. When you start a session, the authentication material for the various tools and the Claude API is managed internally. While the `AnthropicSession` object is there, the actual security controls feel minimal.

For instance, consider a simple agent with a database tool:
```python
agent = AnthropicAgent(
model="claude-3-haiku",
tools=[query_database_tool],
session_parameters={"user_id": "user_123"}
)
```
Where is the detailed log of *which* credential was used for *which* tool call during the session? If this agent is handling PII, I need to prove that access was scoped and logged. Right now, I'd have to wire that up myself entirely outside the SDK's session logic.

Key questions that aren't clearly addressed:
* How are tool credentials isolated between sessions? Is there a risk of leakage?
* Where is the non-repudiation? A session ID alone isn't sufficient for an audit log.
* The session can carry user context, but does it enforce any policy on what tools that user context can access? Not really—that's still up to the tool's implementation.

This makes "compliant out of the box" difficult. For any regulated environment, we're forced to wrap the session creation and every tool call with our own logging and policy checks, which negates much of the SDK's value. I'd love to see session management designed with a zero-trust mindset from the ground up—where the session itself can be a policy enforcement point and a source of verifiable events.