Guide · AI agent security · as of 8 November 2026

Anthropic now grades your Claude settings. We graded our own.

By , Managing Director, BRev Digital ·

On 5 November 2026 Anthropic gave Claude Enterprise owners a security center: one page that compares how an organization has set up Claude chat, Cowork and Claude Code with the configuration Anthropic recommends, control by control, with a report an auditor can read. Most teams using Claude Code are not on Enterprise, and the settings that matter most for Claude Code live in files on each developer’s machine, which the page cannot read anyway. So this morning we ran the same kind of check by hand on our own machine, including a test of the Claude Code sandbox we promised two days ago. One result surprised us, and it is the reason to read this before you switch your own sandbox on.

What Anthropic shipped on 5 November

A posture page, not a certificate.

The security center is in beta for Claude Enterprise and only the organization’s Owners can open it, under Organization settings. It groups the controls into four sets, the organization, chats, Cowork and Claude Code, and shows each control’s current value, the recommended value where there is one, and a status: passed, failed, not attested, or shown for information. A failed control says why it matters and where to change it. The page does not change anything itself. The detail that matters for developers is this. A setting held in device management or in Claude Code’s managed settings file shows as “Check manually”, because the page cannot read it. An Owner can attest to it instead, and the downloadable report marks which controls were checked automatically and which a person confirmed. Anthropic is plain about the limit: the page is guidance based on its own recommendations, and neither it nor the report is a security certification. Anthropic’s help article also does not publish the list of controls, so a team without Enterprise cannot simply copy it. Two other pieces shipped the same day. Inference hooks are now generally available: prompt hooks send prompts to your own security tool to check, and pre-tool-call hooks check a tool call before it runs. And Enterprise and Team customers on macOS and Windows can run their EDR sensor inside the local Cowork virtual machine, in detection mode only, with cloud Cowork sessions not covered.

The Claude Code controls you can check yourself

from Anthropic’s settings docs

Six settings decide most of it.

  • Is there a managed settings file? It sits at /etc/claude-code/managed-settings.json on Linux, /Library/Application Support/ClaudeCode/ on macOS and C:\Program Files\ClaudeCode\ on Windows, and nothing a developer sets can override it. No file means every rule below is a personal choice.
  • Can anyone switch the permission prompt off? disableBypassPermissionsMode set to "disable" in managed settings removes bypass mode. Since version 2.1.257, a repository’s own settings file cannot turn bypass mode on.
  • Whose rules count? allowManagedPermissionRulesOnly and allowManagedMcpServersOnly make the company’s allow-lists the only ones that apply, so a developer or a cloned repository cannot add their own.
  • Is the sandbox on, and does it fail closed? sandbox.enabled, failIfUnavailable so Claude Code refuses to start where the sandbox cannot run, and allowUnsandboxedCommands set to false so a blocked command is never retried outside it.
  • Is the network list strict? allowedDomains lists the hosts commands may reach. Without strictAllowlist, or allowManagedDomainsOnly in managed settings, the list behaves very differently than its name suggests. See what we found below.
  • Can commands read your credentials? The sandbox lets commands read most of the machine and has no built-in credential deny list. sandbox.filesystem.denyRead or permissions.blockReadsOutsideWorkingDirectories close that.

Our own posture, measured this morning

Most of our controls were written rules.

We are an AI lab, and our agents build and ship software with the permission prompt off. On 8 November, on Claude Code 2.1.319, this machine had no managed settings file at all. Our user settings held no permission rules and no sandbox. The project we work in most held 52 allow rules and no deny rules. Five agent sessions were running in bypass mode. Against the six questions above, an honest score is zero of six enforced by the tool. That is not the same as nothing. The database token our agents hold is read-only, secrets sit in a keyring rather than in files the agent reads by default, each agent works in its own git worktree, hooks run before and after tool calls, and a written rule bans any MCP server with write access while prompts are off. But every one of those is a decision we made and wrote down. None of them is a setting Claude Code itself holds, and a posture page would rightly show most of them as “Check manually”.

Why the boundary should sit outside the agent

The sandbox test we promised on 6 November

The allow-list was empty. Everything got through.

We wrote ten read-only checks that a working day here depends on: reach GitHub, the npm registry, the Vercel and Supabase APIs and our own production site, list the SSH folder, read our secrets file, write to the home folder and write to the project folder. Outside the sandbox, all ten worked. Then we ran the same ten inside a Claude Code session with the sandbox on, refusing to start without it and refusing unsandboxed retries, in the bypass mode our agents use. The file side behaved as documented. Writing to the home folder was refused as a read-only file system, and that alone broke npm, which keeps its cache there, and the GitHub command line, which could no longer reach its stored login. Writing inside the project worked. But the SSH folder was still listable and our secrets file was still readable, because the sandbox does not hide credentials unless you tell it to. The network side is the surprise. With an empty allow-list, the Vercel API, the Supabase API and our production site all answered. Anthropic’s documentation explains why: in bypass mode, a connection to a host outside the allow-list is allowed without a prompt, unless strictAllowlist, or allowManagedDomainsOnly in managed settings, is on. We ran it a third time with strictAllowlist and only GitHub and npm allowed. This time the sandbox refused api.github.com, api.vercel.com, api.supabase.com and app.brevdigital.com, and named each one. If your developers run agents with the prompt off and switch the sandbox on without that one key, the network boundary they think they have is not there.

How we run many agents at once

How to check your own Claude Code setup this week

Measure first. Then lock it.

  • Run /status in Claude Code. The Setting sources line names every settings file that loaded and whether a managed source is in force. If there is no managed source, nothing you have read about company policy applies on that machine.
  • Write down the six answers above for each machine that runs agents. That list is your own posture page, and it is what an Enterprise owner would have to attest to by hand anyway.
  • Turn the sandbox on with strictAllowlist from the first day, then add hosts one at a time as the violation list names them. An empty list without strict mode is not a cautious start in bypass mode; it is an open one.
  • Deny reads of credential folders and secret files explicitly with sandbox.filesystem.denyRead. Then test it the way we did: try to read the file from inside the sandbox and confirm it fails.
  • Expect tools that write outside the project to break, npm’s cache and command-line logins first. Add the exact folders they need to sandbox.filesystem.allowWrite rather than turning the sandbox off.
  • Move what holds into managed settings, starting with disableBypassPermissionsMode and the sandbox block, so the policy sits outside the agent and outside the repository it is working in.

What we are doing about it

A list of hosts, then a managed file.

We are not flipping the sandbox on across our working sessions today, because the test shows it would stop npm, our GitHub login and every deploy until the allow-list and the writable folders are right. What we have now is the measured list of what breaks, which is what a learning mode is for. Next comes the strict allow-list, the credential deny-reads and a managed settings file that removes bypass mode for anything touching client data. We will write up the result, including what it cost us in friction, when it has held for a week.

AI agents, built in Dubai

Questions

Questions about Claude Code security settings.

  • What is the Claude security center?

    A beta page in Claude Enterprise, launched on 5 November 2026, that compares an organization’s settings for Claude chat, Cowork and Claude Code against Anthropic’s recommended configuration. Only Owners can open it. It shows each control’s current and recommended value and a status, and offers a PDF report that marks which controls were checked automatically and which an Owner confirmed. Anthropic says it is guidance, not a certification.

  • Where is the Claude Code managed settings file?

    At /etc/claude-code/managed-settings.json on Linux and WSL, /Library/Application Support/ClaudeCode/managed-settings.json on macOS, and in C:\Program Files\ClaudeCode\ on Windows. A managed-settings.d folder next to it can hold separate parts of the policy. Organizations can also deliver the same settings through device management or from the claude.ai admin console.

  • Which Claude Code security settings matter most?

    Whether a managed settings file exists, disableBypassPermissionsMode, allowManagedPermissionRulesOnly and allowManagedMcpServersOnly, the sandbox block with failIfUnavailable and allowUnsandboxedCommands set to false, a strict network allow-list, and deny-reads on credential files. Anthropic’s organization example uses most of these, while noting it is not a recommended policy for every company.

  • Does the Claude Code sandbox block network access in bypass mode?

    Not by default. Anthropic’s documentation says that in bypassPermissions mode a connection to a host outside the allowed domains is allowed without a prompt, unless strictAllowlist or allowManagedDomainsOnly is on. In our own test on 8 November 2026, three hosts outside an empty allow-list answered until we turned strictAllowlist on, after which the sandbox refused all four we probed.

  • Can Claude Code read my SSH keys and .env files?

    Without extra settings, often yes. The sandbox restricts writes but lets commands read most of the machine, and Anthropic states there is no built-in credential deny list. Add the paths to sandbox.filesystem.denyRead and permissions.deny, or set permissions.blockReadsOutsideWorkingDirectories, and then test that a read actually fails.

  • What are Claude inference hooks?

    A Claude Enterprise feature, generally available since 5 November 2026, that sends prompts, and with pre-tool-call hooks the tool calls Claude is about to make, to your own security tool to check before they go ahead. It works with existing security vendors and data loss prevention policies.

Sources

read 8 November 2026

Check it at the source.

  1. Claude: more visibility and control over Claude Enterprise for security teams (5 November 2026, the announcement)
  2. Claude Help Center: the security center (who can open it, statuses, attestation, the report)
  3. Claude Code docs: example settings files (the organization managed-settings example)
  4. Claude Code docs: deploy managed settings (file locations per operating system)
  5. Claude Code docs: sandboxing (the allow-list, bypass mode, what the sandbox does not cover)
  6. Claude Code docs: security (Anthropic’s own best practices)

A question?

Do you know what your agents are allowed to do?

Tell us which AI coding tools your team runs, and we will go through the same six questions with you and show you what holds and what is only written down.

Talk to usWhatsApp +971 50 728 5494hello@brevdigital.com