Claude Code for enterprise: policy, permissions, audit, and spend

Decision one: pick the billing rail

The rail decides your billing, your compliance inheritance, your audit surface, and which Claude Code features your developers can reach. Change it later and every other decision on this page moves with it, so take it first and deliberately.

Whichever rail you choose, the proxy, custom CA, and mTLS requirements in Anthropic’s network configuration guidance apply the same way, and a gateway can sit in front of any of them.

Decision two: how policy reaches machines

Claude Code reads settings from several sources and applies the highest-priority one. Managed settings sit at the top and cannot be overridden by a developer, which is the property that makes the whole model work.

There are three ways to deliver the same file, and they do not merge: Claude Code applies the first source that returns a non-empty configuration. Server-managed settings from the claude.ai admin console reach any machine where the developer is signed into your organization, and are the lowest-effort option; an MDM-pushed file works before first login, which is the only way to enforce login policy itself; a hand-placed file is for pilots. If you use two, keep the login-enforcement keys in both, because a cached server-managed configuration replaces the device file rather than merging with it.

Decision three: what to enforce

A starting policy should be short enough that people read it and strict enough that the obvious accidents cannot happen. Everything below is a managed-settings key, and the ones marked managed-only cannot be set by a developer at all.

{
  "$schema": "https://json.schemastore.org/claude-code-settings.json",

  "forceLoginMethod": "claudeai",
  "forceLoginOrgUUID": "<your-org-uuid>",

  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./secrets/**)",
      "Bash(curl:*)",
      "Bash(git push --force:*)"
    ],
    "ask": ["Bash(git push:*)"],
    "disableBypassPermissionsMode": true
  },
  "allowManagedPermissionRulesOnly": false,

  "allowedMcpServers": [{ "serverName": "github" }],
  "allowManagedMcpServersOnly": true,
  "disableClaudeAiConnectors": true,

  "availableModels": ["sonnet", "haiku"],
  "enforceAvailableModels": true,

  "allowedHttpHookUrls": ["https://hooks.internal.example.com/*"],
  "cleanupPeriodDays": 30,

  "companyAnnouncements": [
    "Agent policy: docs.example.com/ai. Report anything odd in #ai-platform."
  ]
}

• deny beats everything. Put secrets files and credential exfiltration paths here, not in ask. A prompt a developer sees forty times a day is a prompt they stop reading.
• disableBypassPermissionsMode stops a developer from switching the session into a mode that skips approvals. Set it before you argue about individual rules.
• allowedMcpServers with allowManagedMcpServersOnly is the real MCP control. An empty allowlist is a full lockdown; deniedMcpServers takes precedence over the allowlist when both name a server.
• availableModels needs enforceAvailableModels to apply to the Default option too. Without the second key, restricting the list leaves the default route open, which is the most common way this control is set and does nothing. Decide what belongs on the list from evidence rather than habit: the cards for Claude Opus 5 and Claude Fable 5 carry the published coding scores next to the rates you will pay for them.
• allowManagedPermissionRulesOnly stops project and user settings contributing permission rules at all. Powerful, and heavy-handed: turn it on when a repository has been caught allowlisting its own way around policy, not before.
• claudeMd injects organization-wide instructions as CLAUDE.md-style memory, honored only from managed settings. Keep it under a screen; it is prepended to every session your organization runs.

Decision four: audit and telemetry

Three surfaces answer three different questions, and buying one and expecting another is the usual disappointment.

OpenTelemetry is the only one that works on every rail, including Bedrock, Google Cloud, and Microsoft Foundry, where Claude Code sends no metrics back to Anthropic at all and the dashboards therefore see nothing.

{
  "env": {
    "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
    "OTEL_METRICS_EXPORTER": "otlp",
    "OTEL_LOGS_EXPORTER": "otlp",
    "OTEL_EXPORTER_OTLP_PROTOCOL": "grpc",
    "OTEL_EXPORTER_OTLP_ENDPOINT": "http://collector.internal.example.com:4317",
    "OTEL_EXPORTER_OTLP_HEADERS": "Authorization=Bearer <token>",
    "OTEL_RESOURCE_ATTRIBUTES": "cost_center=eng,team.id=platform",
    "OTEL_METRICS_INCLUDE_SESSION_ID": "false"
  }
}

• Metrics worth alerting on: claude_code.cost.usage in USD, claude_code.token.usage, claude_code.session.count, and claude_code.active_time.total.
• Every metric and event carries session.id, user.id, organization.id, app.version, and app.entrypoint, so cost attributes cleanly by person and by surface.
• The cost metric also carries model, query_source (main, subagent, or auxiliary), and effort, which is how you find out that your subagents cost more than your main sessions.
• OTEL_RESOURCE_ATTRIBUTES takes no spaces. Use underscores. It is the cleanest way to stamp a cost center onto every datapoint.
• Turn OTEL_METRICS_INCLUDE_SESSION_ID off once you are past the pilot. It is on by default and it is the largest single driver of metric cardinality.
• Enterprise Analytics API keys are minted by a Primary Owner at the analytics API keys page with the read:analytics scope. The API is not available on the Teams plan.

Decision five: where the spend ceiling sits

Every rail can be capped, but the mechanism is different on each one, and a mixed organization has to set all of them because each developer is metered by whichever credential they signed in with.

On the Console rail there is a detail worth knowing: a workspace called "Claude Code" is created automatically on first authentication, you cannot mint API keys inside it, and it exists precisely so Claude Code spend is isolated and cappable. Set a workspace rate limit as well as a spend limit, so an agent run cannot crowd out production traffic sharing your organization’s quota.

When a gateway earns its keep

A gateway becomes the right answer at the point where you want one credential store, one request log, and per-developer spend caps across more than one provider. Anthropic ships its own self-hosted Claude apps gateway that signs developers in through your IdP, routes to Bedrock, Google Cloud, or Microsoft Foundry, applies per-group model access, exports OTLP telemetry, and enforces per-developer spend limits live on every request. Third-party LLM gateways work too, with ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN distributed through the same managed settings.

A rollout that does not stall

Questions people ask

Keep reading

Continue through AI spend and governance with T3 Code for teams: what it covers, and what you have to cover yourself.