Claude Code Security: What Managed Settings Lock Down and What Still Leaves the Laptop

Last updated: October 29, 2026

Claude Code security comes in two halves. Anthropic's managed settings control what the agent is allowed to do on a developer's machine and which organization it signs into, but they don't read the source code, keys and customer data inside the prompts Claude Code sends, and they don't govern Claude in the browser or desktop app. dope.security covers the other half on the device: Dopamine DLP inspects Claude traffic from the CLI, VS Code and Cursor, and Cloud Application Control keeps every Claude surface on your enterprise org.

Claude Code has gone from “a few engineers trying it” to “the default way half the team writes code” in a lot of companies this year. It runs in a terminal, reads your repo, edits files, runs commands and calls out to tools through MCP. That's a lot of power on a laptop that also has production credentials in a dotfile somewhere.

Security teams usually ask two questions about it: what can the agent do, and what can leave? Anthropic gives you strong answers to the first. This guide covers both, and shows where dope.security fits next to the controls Anthropic ships. If you're governing Claude more broadly, start with our guide to Claude enterprise controls for governing Claude at work.

One note on naming: Anthropic also offers code review and vulnerability-finding features for your codebase. This post isn't about those. It's about securing Claude Code itself as a tool your developers run every day.

What are the security risks of Claude Code in the enterprise?

The risks come from the same things that make it useful: it reads a lot, it acts on its own, and it talks to the network. Three stand out for security teams.

• Data in prompts. To help with a task, Claude Code sends context to the model: file contents, diffs, error logs, sometimes config. If a .env file, a hardcoded API key or a customer data fixture is in scope, it can end up in that context.
• Actions on the machine. Claude Code can run shell commands. A permissive configuration plus a confused or manipulated agent can run things nobody intended, including network calls through curl or wget.
• Account and tool sprawl. Developers may sign in with a personal Claude account, wire up MCP servers you've never reviewed, or use Claude in the browser and desktop app alongside the CLI.

None of these require a malicious employee. They show up in normal, well-intentioned work, which is exactly why they need controls that don't depend on everyone remembering the rules.

What Claude Code's managed settings actually control

Anthropic's administrator documentation is clear and worth reading in full. Claude Code enforces organization policy through managed settings that take precedence over a developer's local configuration. You can deliver them from the Claude admin console (server-managed settings, on Team and Enterprise plans), through MDM using a macOS plist or Windows registry policy, or as a managed-settings.json file in a system directory.

According to Anthropic's docs, those settings can:

• Allow, ask or deny specific tools and commands with permissions.allow and permissions.deny. Array settings merge across sources, so developers can extend your managed lists but can't remove entries from them.
• Lock down permissions with allowManagedPermissionRulesOnly, and disable the --dangerously-skip-permissions bypass mode.
• Sandbox execution with OS-level filesystem and network isolation and a domain allowlist (sandbox.enabled, sandbox.network.allowedDomains).
• Restrict MCP servers with allow and deny lists, or a fixed managed set.
• Enforce login to a specific method or Anthropic organization with forceLoginMethod and forceLoginOrgUUID.
• Export usage telemetry through OpenTelemetry for sessions, tools and tokens.

Anthropic also makes an important point itself: permission rules and sandboxing cover different layers. Denying the WebFetch tool blocks Claude's fetch tool, but if Bash is allowed, curl and wget can still reach any URL. The sandbox's network allowlist is what closes that gap.

That's a serious, well-designed control set. Configure it. Then look at what it isn't built to do.

What managed settings don't cover

Managed settings govern the agent's behavior, not the meaning of the data it sends. That leaves three gaps a security team still owns.

Gap 1: Nobody is reading the prompt content

An allowlist can make sure Claude Code only talks to Anthropic's API. It can't tell you whether the request it just sent contained your payment service's source code, a database connection string or a CSV of customer records. Permissions decide where traffic can go. Data loss prevention decides what is allowed to go there.

Gap 2: Claude Code is only one Claude surface

Claude Code's settings apply to Claude Code. The same developer can open Claude in a browser tab or the Claude desktop app, paste the same file, and none of those settings apply. A personal Claude account in Chrome is outside Claude Code's reach entirely.

Gap 3: Settings only work where they're deployed

Managed settings protect the machines that receive them. Anthropic notes that the Windows user registry location is writable without elevation, so it's a convenience default rather than an enforcement channel, and that WSL reads its own Linux path unless you explicitly extend Windows policy to it. Contractors, new hires and personal side projects on managed laptops are where coverage quietly drifts.

Claude Code managed settings vs. dope.security: who covers what

This isn't either/or. The strongest setup uses both, because they work at different layers. Here's how the responsibilities split.

• Which commands the agent may run: Claude Code managed settings handle this with permission rules and bypass lockdown; dope.security doesn't try to.
• Which domains the agent's shell can reach: the Claude Code sandbox allowlist handles this for sandboxed sessions; dope.security adds URL filtering and category policy across every process on the device.
• What data leaves in prompts: Claude Code settings don't classify prompt content; dope.security's Dopamine DLP reads prompts and uploads and detects IP, PII, PCI and PHI.
• Which Claude account is used: forceLoginOrgUUID pins Claude Code logins to your org; dope.security Cloud Application Control restricts Claude to your approved organization IDs across the browser and desktop app too.
• Visibility across AI tools: Claude Code exports its own telemetry; dope.security's AI Usage Analytics shows ChatGPT, Claude, Gemini, Copilot and shadow AI by user, with personal versus enterprise account breakdown.
• MCP servers: Claude Code can allow or deny MCP servers it connects to; dope.security Shadow IT surfaces MCP server domains employees reach from any tool.

How dope.security adds the missing layer on the device

dope.security runs a lightweight agent on Mac and Windows that performs SSL inspection locally, on the laptop, with no detour through a vendor data center. Because it sits at the endpoint rather than in a browser, it sees traffic from terminals, IDEs and desktop apps, not just Chrome tabs.

Dopamine DLP for Claude prompts

According to the dope.security Inflight documentation, Dopamine DLP's Claude support covers the Claude desktop app and integrations including the CLI, VS Code, Cursor, Cowork and Microsoft add-ins. Dopamine DLP uses LLMs to classify content by meaning, so it recognizes intellectual property like source code without a library of brittle regex patterns. It also detects PII, PCI and PHI that slip into test fixtures and logs.

You choose the response per policy. In Monitor mode, the developer is notified, a violation is logged and the request goes through. In Block mode, the request is stopped. You can set exceptions by user or group, so a security research team can stay in Monitor while everyone else runs Block. A DLP URL Bypass list lets you skip DLP inspection for trusted destinations without turning off SSL inspection or Cloud Application Control.

One setup step for developer tools

CLI and Node-based tools don't always read the operating system's certificate store. Inflight documents a certificate step for Claude integrations: point NODE_EXTRA_CA_CERTS (and on Windows, SSL_CERT_FILE) at the dope.security root certificate, deploy it machine-wide through your MDM, and restart the affected apps. Inflight also recommends validating on a pilot group across both operating systems before a fleet-wide rollout. Do exactly that: confirm in your own console that DLP detections fire for your developers' Claude Code workflows before you switch to Block.

Cloud Application Control for Claude

Cloud Application Control lets you approve one or more Claude enterprise organization IDs and block personal free and personal paid accounts. Enforcement happens on the device, so it covers both browser and desktop app usage and works on any network, including home Wi-Fi and hotel connections. Pair it with forceLoginOrgUUID in Claude Code, and personal Claude accounts have nowhere to go on a managed laptop. Our walkthrough of Claude DLP for stopping data leaks covers the CAC and DLP setup in more depth.

Visibility you can act on

AI Usage Analytics shows which AI apps are in use, who's using them and how much data they move, with a personal versus enterprise-licensed account breakdown. You can block an app or enforce enterprise-only access from the same screen. The Dopamine agent answers plain-language questions over that data, such as which users sent sensitive data to AI tools this week. For a wider look at developer AI, see our roundup of top shadow AI tools for Claude Code, Cursor and developer AI.

A Claude Code security checklist you can run this quarter

Here's the order we'd roll it out in, combining Anthropic's controls with dope.security's.

• Pick one delivery channel that can't be overridden. Use server-managed settings, or the macOS plist and Windows HKLM registry through MDM. Don't rely on HKCU.
• Lock permissions. Deny destructive commands, require approval for network tools, and disable bypass mode.
• Turn on the sandbox where your platforms support it, with a network allowlist that matches what your developers actually need.
• Pin logins to your Anthropic organization with forceLoginOrgUUID.
• Review MCP servers. Allow the ones you've vetted and deny the rest. Our guide to MCP server security and governance covers what to check.
• Deploy dope.security to engineering through Intune, Jamf or Kandji, along with the root certificate and environment variables.
• Turn on Claude Cloud Application Control so personal accounts are blocked in the browser and desktop app too.
• Run Dopamine DLP in Monitor mode for two weeks, then share findings with engineering leadership before moving high-risk repos and teams to Block.

How to roll it out without a developer revolt

Engineers will route around controls that slow them down or block them without explanation. So don't lead with Block. Lead with data. A week of AI Usage Analytics and Monitor-mode DLP usually tells a clearer story than any policy memo: which repos are showing up in prompts, which personal accounts are in use, which MCP servers nobody approved.

Speed matters too. dope.security doesn't detour traffic through a data center, uses under 100 MB of RAM, and runs up to 4x faster than legacy proxy SWGs, so git, package installs and AI completions aren't waiting on a round trip. That's how large rollouts move quickly: a Fortune 100 company scaled from 900 to over 18,000 devices in weeks, deploying silently through Intune. The full story is in our Fortune 100 deployment case study.

If you've already done this exercise for Cursor, the same pattern applies; our breakdown of Cursor AI security and what Privacy Mode leaves to you follows the same two-layer logic.

The bottom line on Claude Code security

Restated plainly: Anthropic's managed settings are the right way to control what Claude Code can do, but a complete Claude Code security program also needs something that reads what Claude Code sends and keeps every Claude surface on your enterprise org, and that layer belongs on the device. Configure both and you get developer speed without handing your codebase to a personal account. See your AI usage with dope.security, start a free trial, or book a 20-minute demo.

Frequently Asked Questions

Is Claude Code safe to use in the enterprise?

Claude Code can be used safely when you deploy it with managed settings that lock permissions, enable sandboxing and pin logins to your organization. Anthropic states it doesn't train models on code or prompts on Team, Enterprise, API and cloud provider plans. The remaining risk is sensitive data in prompts and use of other Claude surfaces, which dope.security addresses with on-device DLP and Cloud Application Control.

Can I block personal Claude accounts but allow Claude Code for work?

Yes. In Claude Code, the forceLoginOrgUUID managed setting restricts claude.ai logins to your Anthropic organization. dope.security Cloud Application Control blocks personal free and paid Claude accounts in the browser and desktop app while allowing your approved enterprise org IDs.

Does Claude Code's sandbox stop data exfiltration?

The sandbox limits which domains sandboxed commands can reach, which closes paths like curl to an arbitrary URL. It doesn't inspect what's sent to allowed destinations, including Anthropic's own API. Content-level protection needs DLP, such as dope.security's Dopamine DLP on the device.

Can a DLP tool see Claude Code traffic from the terminal?

Browser-based DLP and DNS filters can't read terminal traffic. dope.security's Inflight documentation lists Claude CLI, VS Code and Cursor integrations as supported by Dopamine DLP, with a one-time certificate step so Node-based tools trust the dope.security root certificate. Validate detections on a pilot group before enforcing.

How do I see which developers are using Claude Code?

Anthropic offers usage analytics and OpenTelemetry export for Claude Code itself. dope.security's AI Usage Analytics adds a cross-tool view of ChatGPT, Claude, Gemini, Copilot and shadow AI by user, including personal versus enterprise account usage.

Do I need a cloud proxy to secure Claude Code?

No. A cloud proxy detours developer traffic through a vendor data center and often breaks CLI tools that pin certificates or ignore the system trust store. dope.security inspects on the device, with no detour, and documents the certificate setup for Claude integrations.