Detects when a Claude project owner or editor role is granted via a role_assignment_granted event in Anthropic audit logs. Owners/editors can access project chats, artifacts, and knowledge bases that may contain sensitive data. An attacker with organization-level access could grant these roles to persist access to high-value project content without needing organization admin privileges. The rule fires on data_stream.dataset: "anthropic.audit" with event.category: "iam" and event.action: "role_assignment_granted" when user.target.roles includes either "chat_project:owner" or "chat_project:editor". It is a New Terms rule with a risk_score of 47 and a severity of medium. MITRE ATT&CK mappings include T1098 Account Manipulation (subtechnique T1098.003 Additional Cloud Roles) under Persistence and Privilege Escalation, highlighting the abuse of cloud IAM to maintain access. Investigation_fields capture relevant event attributes (e.g., organization.id, anthropic.audit.resource_id, anthropic.audit.target_id, related.user, user.email, source.ip, user_agent.original). The rule is designed to surface first-seen grants within the ingestion window (now-9m) from index logs-anthropic.audit-*. Remediation guidance emphasizes revoking the unauthorized project role, auditing related project/org changes, and reviewing access to project content and exports. False positives include legitimate project onboarding or recurring collaborators and possible automation workflows; analysts should verify the assigner, project, and grantee against expected baselines. References point to the Claude API compliance activities for context.