A county open-data team writes ETL scripts in Claude Code and serves the public with a separate API bot. What design separation fits?

Internal ETL coding with Claude Code and public open-data answering are different trust and blast-radius problems. Separating internal Claude Code ETL use from the public API application works because developers can use powerful coding agents on county pipelines while residents hit a constrained API bot that cannot open shells, edit jobs, or touch unpublished datasets. Clear separation prevents accidental privilege bridging between engineering tooling and citizen-facing services. Hosting the public API bot inside the Claude Code ETL workspace fails because it pulls citizen-facing traffic into the shell-capable engineering environment, exposing ETL credentials, jobs, and unpublished datasets to the public bot. Linking the public portal queries to the ETL coding session context fails conceptually by merging resident questions with developer session state, secrets, and pipeline code in one conversational context. Routing scheduled county ETL batch jobs through the public API bot endpoint fails as architecture: the public endpoint is built for resident queries, not internal scheduled batch jobs, and it couples citizen traffic to private ETL runs. Exam caveat: separation of products still requires network and credential isolation—calling both "Claude" does not create a boundary if they share tokens or writable storage. Operational check: run Claude Code only on staff workstations or private CI for ETL, deploy a separate API application for the public portal, and verify the public bot’s tool allow-list excludes shell and warehouse-admin actions.