Skip to main content

Buyer guide

Claude Code Permissions & Data-Handling Checklist

Permission modes, managed settings, the shell sandbox, MCP controls, and the data terms of each plan, checked against Anthropic's documentation.

Reading time
4 min read
Sources
11 cited
In this piece
Claude Code+75 Strong positive

The call

Set the permission mode and deny rules in server-managed settings or MDM, where project files cannot override them.

Turn on the shell sandbox where your operating systems support it, allow only approved MCP servers, and keep every engineer on Team, Enterprise or API terms.

Since version 2.1.283, a Claude Code terminal session starts in auto mode wherever auto mode is available, and a background classifier approves actions in place of a person. Unless you change that before rollout, the agent acts on it from the first session, and shell commands run outside any sandbox, which is off by default.

When you need this

  • Engineers run Claude Code with default settings and nobody has chosen the permission mode.
  • Security asks where prompts and code are stored, for how long, and whether they train models.
  • Agents read untrusted content such as issues, web pages, or dependencies while holding credentials.

Worked example: how Intercom governs agents on engineers' machines

  1. Allowlist from evidence

    Intercom's analyzer reads two weeks of session transcripts and sorts the commands people approved into tiers, which become its permission rules.

  2. Limit what tools reach

    Its production console MCP server has read-replica-only access and blocks critical tables.

  3. Gate risky steps

    A PreToolUse hook blocks a raw gh pr create until the team's create-pr skill has run.

  4. Audit without content

    Intercom sends 14 lifecycle event types to Honeycomb through OpenTelemetry and never captures prompts, messages or tool input.

Security review checklist

  1. Permission mode

    Which mode does a session start in, and which modes are allowed?

    SetManual mode (config value default) runs only reads without asking. The acceptEdits mode adds file edits, and plan mode blocks edits until you approve a plan. Auto mode runs everything with background classifier checks. The dontAsk mode denies anything not pre-approved and suits CI. The bypassPermissions mode skips checks and belongs only in isolated containers and VMs. In managed settings, choose the start mode with permissions.defaultMode, set permissions.disableBypassPermissionsMode to disable bypass mode, and set permissions.disableAutoMode if a person must approve actions.

  2. Permission rules

    Which commands and paths are always blocked or always asked?

    SetDeny rules block in every mode, including bypassPermissions, and ask rules such as Bash(git push *) prompt in every mode. The allowManagedPermissionRulesOnly setting makes managed settings the only source of rules. Build the allowlist from the commands engineers already approve, as Intercom does.

  3. Policy delivery

    How does policy reach every machine?

    SetUse server-managed settings from the claude.ai admin console (fetched at startup and hourly), an MDM profile through Jamf, Intune, or Group Policy (checked every half hour), or a managed-settings.json file. A developer's own settings files and flags never override a managed value. The forceRemoteSettingsRefresh setting blocks startup until a fresh policy loads, and /status shows which source is in force.

  4. Shell sandbox

    What can a shell command reach?

    SetThe sandbox is off by default. With it on, commands write only to the working directory and a temp directory, and reach the network only through a local proxy that admits the domains you allow. Commands can still read ~/.ssh and ~/.aws until you add sandbox.credentials entries. Enforce the sandbox with sandbox.enabled, failIfUnavailable, and allowUnsandboxedCommands set to false. It runs on macOS, Linux, and WSL2. On native Windows it does not run at all.

  5. MCP servers and plugins

    Which tools and integrations can the agent load?

    SetPublish approved servers with allowedMcpServers and set allowManagedMcpServersOnly, or deploy a fixed set with managed-mcp.json. Restrict plugin sources with strictKnownMarketplaces. Give any MCP server that touches production read-only access, as Intercom does.

  6. Data terms by plan

    Is every engineer on commercial terms?

    SetTeam, Enterprise, API, and cloud-provider usage does not train models unless the customer opts in. Free, Pro, and Max data does when the setting is on. Commercial retention is 30 days, and Anthropic enables zero data retention per organization for qualified Enterprise accounts. On the engineer's machine, session transcripts sit in plaintext under ~/.claude/projects/ for 30 days by default (cleanupPeriodDays).

  7. Audit trail

    Can you see what agents did and under which policy?

    SetOpenTelemetry export includes permission mode changes and managed settings resolution events. Send lifecycle events to your observability tool and leave prompts and tool input out, as Intercom does with Honeycomb.

Questions to settle before rollout

  1. Which permission mode does a new terminal session start in on our machines, and who decided?
  2. Which actions need a person's approval in every mode, such as git push, deploys, and production database access?
  3. Does the shell sandbox run on every operating system our engineers use, and what is the plan for native Windows?
  4. Which MCP servers and plugins are approved, and who reviews a new one?
  5. Is anyone using Claude Code with company code on a personal plan?
  6. Do we need zero data retention, knowing that analytics contribution metrics are unavailable with it?

Red flags

  • bypassPermissions on a laptop with credentials and network access.
  • An agent that holds private data, reads untrusted content, and can send data out, which Simon Willison calls the lethal trifecta.
  • A sandbox without credential protections, leaving ~/.ssh and ~/.aws readable.
  • Policy delivered only as a project settings file that any developer can edit.

Products in this piece

Sources

Official documentation
9
Public source
2
  1. Claude Code docs: Choose a permission modeOfficial documentationcode.claude.com
  2. Claude Code docs: Configure permissionsOfficial documentationcode.claude.com
  3. Claude Code docs: SettingsOfficial documentationcode.claude.com
  4. Claude Code docs: Deploy managed settingsOfficial documentationcode.claude.com
  5. Claude Code docs: Configure the sandboxed Bash toolOfficial documentationcode.claude.com
  6. Claude Code docs: Managed MCP configurationOfficial documentationcode.claude.com
  7. Claude Code docs: Data usageOfficial documentationcode.claude.com
  8. Claude Code docs: MonitoringOfficial documentationcode.claude.com
  9. Claude Code docs: Track team usage with analyticsOfficial documentationcode.claude.com
  10. Intercom: How we use Claude Code today at Intercom (Brian Scanlan, Mar 19, 2026)Public sourceideas.fin.ai
  11. Simon Willison: Living dangerously with Claude (Oct 22, 2025)Public sourcesimonwillison.net

Keep reading

  1. Buyer guideAmp Team Rollout and Spend ChecklistWhat to settle before engineers move from personal Amp accounts to a shared workspace, and how to grade the pilot when it ends.
  2. Buyer guideHanding a Bolt App to EngineeringHow GitHub sync, branches, the Supabase database claim, Netlify, and Expo work, where each stops, and the setup an engineer or a coding agent needs to take the code over.
  3. Buyer guideClaude Code Workflow PlaybookHow to brief Claude Code and check its work so a reviewer accepts the change on the first pass, with an annotated CLAUDE.md and a pre-merge checklist.
Read the research