Detects when an organization admin role is assigned to a user in Anthropic Claude for Enterprise by matching a claude_user_role_updated event where anthropic.audit.current_role equals 'admin'. This indicates promotion to org-level administration, enabling control-plane actions such as disabling SSO, minting admin API keys, exporting data, and changing integrations or audit settings. The rule intentionally excludes workspace-scoped role_assignment_granted events. It relies on Anthropic audit logs (anthropic.audit) and filters for events with data_stream.dataset = 'anthropic.audit', event.category containing 'iam', and event.action = 'claude_user_role_updated' with current_role = 'admin'. The rule returns relevant fields (IDs, timestamps, organization, user, and audit context) for investigation. It maps to MITRE ATT&CK techniques T1098 (Account Manipulation) with subtechnique T1098.003 (Additional Cloud Roles), under Persistence and Privilege Escalation, highlighting how an actor could gain durable admin access. False positives include legitimate onboarding or staffing changes that grant org admin via a formal change process. The rule is designed to catch suspicious or unapproved promotions and trigger incident response actions. The rule context notes that workspace-scoped role grants are out of scope.