Governance · Claude Code
Permissions and governance for using Claude Code safely as a team
Claude Code runs shell commands and edits files on a developer’s machine, with that developer’s permissions. Before a team adopts it, decide what is allowed automatically, what must ask, and what is denied — then turn that into managed settings, sandboxing, MCP and CI configuration. This is about how the tool itself is used, not a review of the code it writes.
Pricing: Spot review From $680 / Standard audit From $1,900
Configuration alone cannot fully protect a machine. The Claude Code docs themselves state where permission rules and server-managed settings are not a security boundary. The design layers them with OS permissions, MDM and the sandbox.
Scope
What gets designed and checked
Only features in the official documentation as of October 2026. Version-dependent behavior is verified against the version you deploy.
Permissions and the settings hierarchy
- Which permission modes (Manual, acceptEdits, plan, auto, dontAsk, bypassPermissions) each group may use
- Designing allow / ask / deny rules (evaluated deny → ask → allow; specificity does not change the order)
- How managed settings are delivered (settings file, MDM, server-managed) and which keys developers cannot override
- Whether to disable
bypassPermissionsand auto mode organization-wide
Isolation and secrets
- Turning on the sandbox (off by default) and denying reads where needed (by default it can read
~/.sshand similar) - Where secrets live, given that a
Read(./.env)deny does not stop scripts or child processes - Allowed network domains, and exfiltration paths opened by overly broad ones (e.g. all of github.com)
- What runs inside containers or VMs
Trusting extensions
- MCP allow and deny lists, and a fixed organization-wide
managed-mcp.json - Whether to adopt third-party MCP servers (Anthropic does not security-audit MCP servers)
- Managing hooks (which run commands with the user’s permissions), and whether to allow only managed hooks
- Restricting plugin marketplaces
CI and auditability
- Running in GitHub Actions: who can trigger it, untrusted PRs, storing the API key
- With
claude -pthere is no trust dialog, so a repository’s hooks and.mcp.jsonrun as-is — countermeasures such as--bare - Visibility through OpenTelemetry (prompt text is not logged by default)
- Data handling (training and retention under commercial terms) checked against your internal policy
Timing
When to design it
Between a small pilot and rolling out to everyone
Personal settings that spread first are hard to tighten later; exceptions multiply.
Before running it in CI or GitHub Actions
It runs where no one is watching, so permissions and tool access are narrowed first.
Before connecting external MCP servers
A server that pulls in outside content is an entry point for prompt injection.
Before using it on client code or personal data
Check that the tool’s configuration matches what contracts and internal policy require.
What it is not
- Not an evaluation or guarantee of Anthropic or the Claude Code product itself. It designs your configuration and operations.
- On unmanaged machines, server-managed settings can be bypassed without admin rights (stated in the official docs). The design assumes device management alongside it.
- No legal advice on contracts or data protection.
Who
Who reviews your app
Audits are taken on by Tomoda Hinata, a freelance full-stack engineer. Judge by the published research, tools and delivered work below, not by a title.
A field study of Supabase RLS (1,000 public repositories)
A static analysis of public repositories: 9.2% (91) of the 994 that ship RLS had a policy that checks sign-in but does not narrow rows to their owner — published after checking all 235 such policies by hand.
Aegis, an open-source security toolkit
Scanners and defensive building blocks for Next.js / Supabase, published under the MIT license. Part of the automated detection used in an audit is something anyone can run locally.
A METI Minister's Award–winning B2B SaaS (lumber distribution)
SoloAll 221 APIs with 0 missing-authorization findings, proven across 4 rounds of self-conducted security review (static review → live testing → penetration testing), with every critical finding, including cross-tenant personal-data exposure, fixed.
An internal AI platform for a broadcaster
TeamEncrypted personal data, audit logs, a WAF and key-less CI/CD built into the initial design rather than bolted on.
Pricing
What it costs
Delivered within the existing audit tiers. Prices are “from” anchors; headcount, device management and CI scope change the quote.
Spot review
You want today’s setup (permission rules, managed settings, MCP, hooks, CI) inventoried and the risks reported in priority order
Turnaround: ~1 week
From $680scoped per project
Standard audit
You want the whole design: policy through managed settings, sandbox, MCP allowlists, CI and monitoring
Turnaround: ~2–3 weeks
From $1,900scoped per project
Turnaround depends on headcount and device management. If you also want the settings rolled out or wired into CI, we scope and quote it on the call.
Frequently asked questions
How is this different from the review of AI-built apps?
That one checks the app Claude Code and similar tools produced for security holes. This one designs how your organization uses Claude Code itself: permissions, managed settings, sandbox, MCP and CI. If you need both, they can be scoped together.
Is turning on the sandbox enough?
Partly. As of October 2026 the docs say the sandbox is off by default, and even when on it allows reading files such as
~/.sshunless you deny them. Tools like Read, Edit and WebFetch, hooks and local MCP servers run outside it. Read restrictions and allowed network domains have to be designed alongside it.If we deny reads of
.env, are our secrets safe?Not on its own. As the docs say, a
Readdeny rule applies to Claude’s file tools but does not stop scripts or child processes from reading the file indirectly. It is combined with keeping secrets off the machine and with sandbox read restrictions.Are the MCP servers listed by Anthropic security-checked?
The docs state that Anthropic does not security-audit or manage MCP servers. A server that pulls in external content is also an entry point for prompt injection, so the organization keeps an allowlist.
Is our code or our prompts used for training?
As of October 2026 the docs say code and prompts sent to Claude Code under commercial terms (Team, Enterprise, API and others) are not used to train generative models, with a standard 30-day retention. Consumer plans depend on the user’s choice. When checking against internal policy, confirm against the current terms of your plan.
How much does it cost?
An inventory of today’s setup with a prioritized report fits the spot review (from $680); the full design from policy to configuration fits the standard audit (from $1,900). Headcount, device management and CI scope change the quote.
Set the scope in 30 minutes, before everyone gets it
Tell us how it is used today and what must stay protected — client code, secrets, production — and we sort out what to decide first.
An NDA can be signed before our first call.