diff --git a/vm/ai-env/ai.env b/vm/ai-env/ai.env
index e81cb07..00507cd 100644
--- a/vm/ai-env/ai.env
+++ b/vm/ai-env/ai.env
@@ -12,6 +12,13 @@ HITL_LANG=ja
 # (console "model" field); ids starting with claude- go to the Claude Messages API (secret selfheal-anthropic-api-key).
 OPENAI_MODEL=gpt-6.1-sol
 EMBED_MODEL=text-embedding-3-small
+# Claude API auth: Workload Identity Federation (platform.claude.com/docs/en/manage-claude/wif-providers/gcp). The four ids are
+# not secrets; the agent exchanges this VM's Google identity token (service account selfheal-ai-vm, unique id 117534696004805578884)
+# for a short-lived access token. Empty = federation off (then the key file selfheal-anthropic-api-key is used, if registered).
+ANTHROPIC_FEDERATION_RULE_ID=
+ANTHROPIC_ORGANIZATION_ID=
+ANTHROPIC_SERVICE_ACCOUNT_ID=
+ANTHROPIC_WORKSPACE_ID=
 HARNESS_URL=http://10.20.0.11:8080
 MIMIR_URL=http://10.20.0.10:9009/prometheus
 LOKI_URL=http://10.20.0.10:3100