Claude Code for Business: 2026
Security Guide

Claude Code is Anthropic's coding agent. It reads your code, runs commands and edits files from the terminal, the IDE or the desktop app. This autonomy is what makes it valuable. It is also why it needs a framework before you roll it out to a team.

This guide covers the seven security levers to configure: permission modes, rules, organization managed settings, the sandbox, MCP servers, hooks and data management. Setting names and examples come from the official Claude Code documentation and its changelog, current as of version 2.1.319.

1. Choose the right permission mode

The permission mode decides what Claude Code can do without asking. You set it with permissions.defaultMode or the --permission-mode option.

Two things to know:

• A project file (.claude/settings.json) cannot enable auto or bypassPermissions. A cloned repository therefore cannot grant itself these rights.
• The administrator can disable these modes. "permissions": {"disableBypassPermissionsMode": "disable"} blocks bypassPermissions, and disableAutoMode blocks auto mode. On Team and Enterprise plans, auto mode is available by default.

2. Write allow, ask and deny rules

Rules specify what is allowed (allow), what requires confirmation (ask) and what is denied (deny). Example:

{
  "permissions": {
    "allow": ["Bash(npm run lint)", "Bash(npm run test *)"],
    "ask": ["Bash(git push *)"],
    "deny": ["Read(./.env)", "Read(./.env.*)"]
  }
}

Claude Code evaluates rules in this order: deny, then ask, then allow. The first match wins. An allow rule can therefore never override a denial.

Rules also apply to web domains (WebFetch(domain:example.com)) and to MCP tools (mcp__serveur__outil).

One limitation is documented: rules that filter the arguments of a Bash command are fragile. A deny rule can be bypassed if the same program is called another way, for example via sh -c. Combine them with the network sandbox described below.

3. Centralize configuration with managed settings

Claude Code reads its settings at several levels. From strongest to weakest: organization managed settings, command line, local project (.claude/settings.local.json), shared project (.claude/settings.json), then user (~/.claude/settings.json).

Managed settings apply to every workstation. There are three ways to deploy them:

• managed-settings.json file in /Library/Application Support/ClaudeCode/ (macOS), /etc/claude-code/ (Linux and WSL) or C:\Program Files\ClaudeCode\ (Windows).
• Device management tool (MDM): com.anthropic.claudecode domain on macOS, HKLM\SOFTWARE\Policies\ClaudeCode key on Windows.
• Admin console for Team and Enterprise plans: Organization settings > Claude Code > Managed settings, restricted to the Owner and Primary Owner roles. These settings are not retrieved if Claude Code goes through a gateway (ANTHROPIC_BASE_URL) or a cloud provider.

Baseline example for a team:

{
  "permissions": {
    "disableBypassPermissionsMode": "disable",
    "deny": ["Read(./.env)", "Read(./.env.*)"]
  },
  "sandbox": {
    "enabled": true,
    "failIfUnavailable": true,
    "allowUnsandboxedCommands": false
  }
}

The allowManagedPermissionRulesOnly setting makes the organization's rules the only valid ones. Version 2.1.319 adds permissions.denyInsteadOfPrompting: an action that would wait for confirmation is denied and the session continues. This is useful for sessions with nobody at the screen. For now, this setting appears in the changelog but not yet in the documentation.

4. Enable the sandbox

The sandbox isolates Bash commands. It is disabled by default. Enable it with the /sandbox command or the "sandbox": {"enabled": true} setting. It works on macOS, Linux and WSL2, but not on native Windows.

• Files: writing is limited to the working folder. By default, reading covers almost the entire machine, including key folders such as ~/.ssh. Protect them with the sandbox.filesystem and sandbox.credentials settings.
• Network: every connection goes through a proxy that filters domain names. The sandbox.network.allowedDomains list is empty at the start. At organization level, sandbox.network.allowManagedDomainsOnly blocks any unapproved domain.

The sandbox has limits. It does not apply to built-in tools such as file reading or web page fetching, which follow the permission rules. Excluded commands (excludedCommands) and commands the developer runs themselves with ! also run outside the sandbox.

5. Control MCP servers

MCP (Model Context Protocol) is the standard that connects Claude to your tools: database, ticketing, CRM. Each MCP server extends what Claude can read and do.

• Project servers: servers declared in a repository's .mcp.json file require approval. A cloned repository cannot approve its own servers.
• Organization lists: allowedMcpServers and deniedMcpServers filter servers by URL, command or name. The deny list always wins. allowManagedMcpServersOnly makes the organization's list the only valid one.
• Exclusive control: a managed-mcp.json file enforces the complete list of allowed servers.

Allowlist example:

{
  "allowedMcpServers": [
    { "serverUrl": "https://*.internal.example.com/*" }
  ]
}

New in version 2.1.319: when an MCP server runs a call as a task, Claude Code moves it to the background and receives the result later. The CLAUDE_CODE_DISABLE_MCP_TASKS=1 variable disables this behavior.

6. Enforce your rules with hooks

Hooks run your own scripts at specific points. The PreToolUse hook runs before each action and can block it, for example to refuse a command that targets a production environment. It cannot override a deny rule.

At organization level, allowManagedHooksOnly limits execution to hooks defined by the administrator.

7. Control your data

• Model training. Under commercial terms (Team and Enterprise plans, API, cloud platforms), Anthropic does not train its models on the code or prompts sent to Claude Code, unless the customer chooses to share their data. For personal accounts (Free, Pro, Max, Ultra), this depends on an account setting. So require business accounts.
• Retention. The standard period is 30 days for commercial accounts. On the workstation, transcripts stay in plain text in ~/.claude/projects/ for 30 days, a period you can change with cleanupPeriodDays.
• Zero retention. Zero data retention is available for eligible Enterprise organizations, on request to Anthropic.
• Cloud providers and gateways. Claude Code can go through Amazon Bedrock (CLAUDE_CODE_USE_BEDROCK=1), Google Cloud (CLAUDE_CODE_USE_VERTEX=1) or an internal LLM gateway (ANTHROPIC_BASE_URL). The managed setting allowedProviders: ["customEndpoint"] forces traffic through your gateway.

Note for teams behind an LLM gateway: since version 2.1.319, in auto mode, calls that the server cannot verify require confirmation or are denied. The CLAUDE_CODE_AUTO_MODE_SERVER=0 variable restores the built-in classifier.

8. Ensure traceability

Claude Code exports its metrics and events via OpenTelemetry (CLAUDE_CODE_ENABLE_TELEMETRY=1). Prompts and tool content are not exported by default. On Team and Enterprise plans, a usage dashboard is available to administrators.

In the news: the email address in web requests

In early November 2026, a GitHub issue reported that in version 2.1.318, Claude sometimes inserted the account email address into the User-Agent header of commands it wrote, for example with curl. It was not a hard-coded header: the address was in the model's context.

Version 2.1.317 had already added a confirmation before a web or shell call sends the account email address. According to the issue, this protection does not yet cover every case. Until a complete fix is available, enable the network sandbox with a list of allowed domains, and keep Claude Code up to date. Version 2.1.319 also fixes several bypasses of permission checks.

Pre-deployment checklist

1. Business accounts (Team, Enterprise or API) for all users.
2. Managed settings deployed on all workstations, with bypassPermissions disabled.
3. deny rules on sensitive files: .env, keys, certificates.
4. Sandbox enabled with a list of allowed domains.
5. MCP server allowlist.
6. Hooks for critical actions, such as deployments.
7. OpenTelemetry telemetry sent to your monitoring tool.
8. Regular updates to the latest version.

Frequently asked questions

Does Claude Code send our code to train models?

Not under commercial terms (Team, Enterprise, API and cloud platforms), unless you choose to share your data. On personal accounts, it depends on an account setting.

Can we stop a developer from disabling the protections?

Yes. Organization managed settings take precedence over user and project settings. They can disable the bypassPermissions and auto modes, enforce the sandbox and restrict MCP servers.

Is the sandbox enough?

No. It isolates Bash commands but not built-in tools. Combine it with permission rules and a domain allowlist.

Can we use Claude Code without going through the Anthropic API?

Yes, via Amazon Bedrock, Google Cloud or Microsoft Foundry, or via an internal LLM gateway. The data policies of the chosen provider then apply.

Let's talk

ZetaBox holds Certified status in the Claude Partner Network. We help development teams roll out Claude Code with settings, MCP servers and processes suited to their security requirements. Explore our Claude implementation services or contact our team.