Claude Code governance: what to enforce, what to request, and how to prove it
Governing Claude Code comes down to a short list of controls that live in the repository and on each machine. Anything that must never happen goes into a permission rule, a hook or the sandbox. Everything else is a request, and the instruction file is where requests belong.
Claude Code governance
- Instructions
- Context only
- Enforce with
- Rules, hooks and the sandbox
- Policy lives in
- Managed settings
- Verify with
- The /status command
- Digiton offer
- Free call, then paid review
The short answer
Govern Claude Code with four layers: a shared instruction file, permission rules that deny secrets and destructive commands, a hook or sandbox that enforces what instructions only request, and managed settings that developers cannot override. Add usage monitoring so spend and tool activity are visible. Whatever you cannot enforce is a request, so write it down as one.
The four controls across three tools
Claude Code is the focus here. Teams rarely run only one coding agent, so the table shows where Codex and Cursor keep the same control. Every cell comes from the vendor's own documentation, read on 19 October 2026.
| Control | Claude Code | Codex | Cursor |
|---|---|---|---|
| Shared instructions | CLAUDE.md, or AGENTS.md when the repository has no CLAUDE.md | AGENTS.md, listed as compatible on agents.md | Project rules in the rules folder, or AGENTS.md as a simpler alternative |
| Permissions | Allow, ask and deny rules. Deny is checked first and the first match decides | A sandbox mode (read-only, workspace-write or danger-full-access) plus an approval policy | Terminal commands need approval by default. Run Modes are best-effort guardrails, not a hard security boundary |
| Hard enforcement | PreToolUse hooks, and an operating-system sandbox for shell commands | The sandbox, with network access off by default in workspace-write mode | Workspace trust, off by default, which organizations can enforce through MDM |
| Organization policy | Managed settings from the admin console, MDM or a file | Managed configuration for enterprise admins | Team Rules from the dashboard on Team and Enterprise plans, with an option to enforce |
Instructions are context, not enforcement
A CLAUDE.md file is a request that Claude usually follows.
Anthropic's documentation says Claude treats these files as context and not as enforced configuration, and it points to a PreToolUse hook to block an action whatever Claude decides. The practical split is simple. Put style, commands and conventions in the instruction file. Put secrets, destructive commands and production access behind rules and hooks. The shorter and more concrete the file, the more consistently it is followed.
Permission rules to write first
- Deny reads of secrets. Add Read deny rules for the .env file and the secrets folder. Anthropic's documentation says a .claudeignore file has no effect, so move its entries into Read deny rules.
- Know the order. Rules are evaluated deny, then ask, then allow, and the first match decides. A narrow allow rule cannot carve an exception out of a broad deny rule.
- Know what deny rules miss. They cover Claude's file tools and the file commands it recognizes in Bash. A Python or Node script that opens files itself sits outside them, and the documentation points to the sandbox for blocking at operating-system level.
- Turn off the bypass. Set disableBypassPermissionsMode to disable in managed settings so no developer can switch the checks off. The auto mode switch works the same way.
- Do not let a hook approve around a deny. A PreToolUse hook that answers allow does not override a matching deny or ask rule, which keeps the deny-first order intact.
- Share the file. Commit the project settings file so everyone who clones the repository gets the same permissions, hooks and plugins. Personal exceptions go in the local settings file.
Managed settings: policy developers cannot edit
- Server-managed settings. Delivered from the claude.ai admin console, highest priority, and available on Claude for Teams and Enterprise. Claude Code fetches them at startup and refreshes them hourly.
- Operating system policy. A plist on macOS or a registry key under HKLM on Windows. Both need admin rights to write, so they resist tampering.
- File-based managed settings. A managed-settings file in a system folder on macOS, Linux and Windows, at medium priority.
- The Windows user registry. Lowest priority, and writable without elevation, so it is a convenience default and enforces nothing.
Array settings such as the allow and deny lists merge entries from every source, so developers can add to a managed list and cannot remove from it. After deploying, run /status in a session and read the Setting sources line, which names the source that won. Teams on Amazon Bedrock, Google Cloud or Microsoft Foundry can get the same remote delivery through a Claude apps gateway, or use the file and operating-system mechanisms.
Usage, spend and audit
Anthropic's administrator guide separates four jobs, and it helps to keep them apart.
Telemetry covers sessions, tools and tokens, exported through OpenTelemetry on every provider. Dashboards show adoption and spend on Teams and Enterprise plans and on the Console. Reporting gives per-user usage and cost over an API. Limits set spend and rate caps in organization settings, or use cloud budget controls on third-party clouds. For request-level audit logs, or to route traffic by data sensitivity, the guide recommends a gateway between developers and the provider. Decide who reads the numbers each month before you decide what to collect.
Which provider you run on changes what you can enforce
- Claude for Teams or Enterprise. One per-seat subscription for Claude Code and claude.ai, no infrastructure to run, and managed settings from the admin console. Anthropic's guide calls it the default recommendation.
- Claude Console. Pay-as-you-go billing for teams that are API-first, with per-user usage and spend metrics.
- Amazon Bedrock. Choose it to inherit existing AWS compliance controls and billing.
- Google Cloud. The same idea for existing controls and billing on GCP.
- Microsoft Foundry. The same idea for Azure.
Some features, including cloud sessions and code review, need a claude.ai account and are unavailable through Console API keys or cloud-provider credentials alone. Plan seats for them if you deploy through a cloud provider.
One policy across Claude Code, Codex and Cursor
Write the policy once in plain language, then implement it three times. A shared AGENTS.md carries the conventions. The agents.md site lists Codex and Cursor among the tools that read it, and Claude Code reads it when the repository has no CLAUDE.md, or through an import from CLAUDE.md.
Enforcement does not travel. Claude Code's deny rules, Codex's sandbox settings and Cursor's team rules each live in their own place, so keep one short document that says what each tool must block and who last checked it. Our comparison of Claude Code, Cursor and Codex covers plans and admin controls, agentjacking defense covers the attack that makes hard enforcement necessary, and AI agent governance in 2026 covers agents beyond coding.
The order to do it in
- Take an inventory. List who runs which coding agent, on which plan or provider, against which repositories.
- Commit the shared file. Put deny rules for secrets and destructive commands in the project settings and review them like code.
- Add the hook and the sandbox. Block what no rule can express, then turn the sandbox on for shell commands and check the paths it protects.
- Deliver managed settings. Push the policy through the admin console, MDM or a file, and have a developer confirm it with /status.
- Watch and review. Turn on usage telemetry, name the person who reads it, and re-read the rules whenever a vendor ships a new setting.
A worked example: rails that do not depend on the prompt
Our own scheduled agents run from a public repository where every send passes unit-tested rails. Every action an agent proposes goes through one function before anything irreversible happens, and the checks run in a fixed order.
Kill switch. Creating one file freezes every job, and nothing runs until the file is removed.
Do-not-contact list. It always wins, even over the allowlist.
Allowlist. An empty allowlist means nothing sends. Addresses and domains are opt-in.
Dedupe. A dedupe key is never actioned twice within 30 days.
Daily cap. The agent stops after a set number of actions a day, and the counter resets at midnight UTC.
Twenty-seven unit tests cover the rails, and CI runs them on three Node versions. We built them after an unguarded email bot ran on a timer with no allowlist, no cap and no off switch, and we shut it down. Claude Code needs the same split: the instruction file requests and the rule decides. The code is on GitHub.
How Digiton helps with Claude Code governance
- Scoping call. Free, 25 minutes, about the system itself, and it decides whether the work fits.
- Production review. We read the real repository and infrastructure and give you a scorecard across ten layers with evidence for each, the result of one load test and a fix list with a cost on every line.
- Fixed-scope build. This follows only if you want us to do the work, and it ends when the acceptance tests pass.
The full standard is on our production engineering page. Larger builds sit under custom AI development, agents acting in your systems under AI agent development, and company-wide policy under AI governance consulting.
Two companion pages cover the people and the apps. Read what a Claude Code consultant should leave behind, and the vibe coded app audit checks for apps an AI tool wrote.
Sources, checked 2026-10-19
12 sources
- Deny rules run first and the first match decides. A .claudeignore file has no effect. Read deny rules do not cover a script that opens files itself, and the sandbox gives operating-system enforcement. A PreToolUse hook cannot override a matching deny or ask rule.Source: code.claude.com, checked 2026-10-19.
- Claude treats CLAUDE.md files as context, not enforced configuration, and a PreToolUse hook is the way to block an action. Claude Code reads AGENTS.md when a repository has no CLAUDE.md, and a CLAUDE.md can import it.Source: code.claude.com, checked 2026-10-19.
- Commit the project settings file so everyone who clones the repository gets the same permissions, hooks and plugins. Personal overrides go in the local settings file. Managed settings sit above user and project settings.Source: code.claude.com, checked 2026-10-19.
- A PreToolUse hook runs before a tool call executes and can block it.Source: code.claude.com, checked 2026-10-19.
- The sandbox is an operating-system boundary around shell commands, covers shell commands only and is off by default.Source: code.claude.com, checked 2026-10-19.
- Managed settings can arrive from the admin console, from operating-system policy or from a file, in a stated priority order. Allow and deny lists merge across sources. The /status command names the source that won. Providers, spend controls, telemetry and the gateway recommendation for audit logging are covered in the same guide.Source: code.claude.com, checked 2026-10-19.
- Claude Code exports sessions, tools and tokens through OpenTelemetry on all providers.Source: code.claude.com, checked 2026-10-19.
- Codex uses a sandbox mode of read-only, workspace-write or danger-full-access plus an approval policy. The workspace-write mode keeps network access off unless enabled. Enterprise admins configure security settings through managed configuration.Source: learn.chatgpt.com, checked 2026-10-19.
- AGENTS.md is an open format for guiding coding agents, and the site lists Codex and Cursor among the tools that read it.Source: agents.md, checked 2026-10-19.
- Cursor offers project rules, user rules, Team Rules on Team and Enterprise plans with an option to enforce, and AGENTS.md as a simple alternative.Source: cursor.com, checked 2026-10-19.
- Cursor requires approval for terminal commands by default, calls Run Modes best-effort guardrails rather than a hard security boundary, ships workspace trust off by default, and says organizations can enforce workspace trust through MDM.Source: cursor.com, checked 2026-10-19.
- Digiton's public agent fleet repository: ten scheduled agents, five rails on every action, unit tests on the rails and CI on Node 18, 20 and 22.Source: github.com, checked 2026-10-19.
Digiton Dynamics OÜ is registered in Tallinn, Estonia, and delivers from Lisbon.
Frequently asked questions
Is CLAUDE.md enough to govern Claude Code?
No. Anthropic's documentation says Claude treats CLAUDE.md as context and not as enforced configuration. Use it for conventions and commands. Anything that must never happen belongs in a deny rule, a PreToolUse hook or the sandbox, and the company-wide version belongs in managed settings.
How do I stop Claude Code reading my .env file?
Add a Read deny rule for the .env path in your settings. A .claudeignore file has no effect on Claude Code. Deny rules cover Claude's file tools and the file commands it recognizes, but not a script that opens files itself, so turn the sandbox on when a hard block matters.
Can developers override managed settings?
Managed values take precedence over user and project settings, with a few security-sensitive exceptions listed in the documentation. Permission lists merge across sources, so developers can add rules and cannot remove managed ones. Settings set through the Windows user registry are the weakest source, because that key is writable without elevation.
Do I need Claude for Teams or Enterprise to enforce policy?
Not for every control. Server-managed settings from the admin console need a Teams or Enterprise plan. Teams on Bedrock, Google Cloud or Microsoft Foundry can use a Claude apps gateway for remote delivery, or deploy an operating-system policy or a managed-settings file.
How do I see what Claude Code did?
Export OpenTelemetry data for sessions, tools and tokens, which works on every provider. Teams and Enterprise add an analytics dashboard, and Anthropic recommends a gateway for request-level audit logs. Pick one person who reads the numbers on a schedule.
Does the same policy cover Codex and Cursor?
The written policy can. The enforcement cannot, because each tool keeps its permissions, sandbox and organization settings in different places. Share the conventions in AGENTS.md and implement the blocks separately in each tool.
Talk to an engineer about your system
Book a free 25-minute scoping call. We tell you what we would build, what it takes to keep it running, and whether we are the right fit.