Enterprise Claude Code hardening
Organization-level guardrails that make AI-assisted coding safer across macOS, Linux/WSL2 and Windows—without relying on every developer to configure controls correctly.
The problem
AI coding tools need access to a developer workflow, but unrestricted access can expose credentials, permit destructive commands, or allow local settings to weaken organizational policy. The objective was a repeatable security baseline that remains consistent across developer operating systems.
Implementation
- A single managed-settings policy defines the approved security floor.
- Permission rules deny reading common secret, credential and private-key locations.
- Destructive operations such as recursive deletion, force pushes, hard resets and clean operations are denied.
- Permission bypass is disabled; only managed permission rules and hooks are allowed.
- macOS and Linux/WSL2 enable OS-backed Bash sandboxing and prevent unsandboxed command fallback.
- Platform installers validate JSON, back up existing settings, deploy system-wide policy and lock file permissions.
Platform-aware design
macOS uses its built-in Seatbelt sandbox. Linux and WSL2 use bubblewrap and explicitly report when that dependency is not present. Native Windows receives the managed deny rules, but does not offer the same OS-level Bash sandbox; the implementation clearly directs teams with stricter threat models to WSL2.
Verification
Post-install checks confirm that managed deny rules appear in the permissions view and that project-local configuration cannot re-allow a blocked command. On macOS and Linux/WSL2, the sandbox status is also checked to confirm enforcement is active—not merely configured.
Frequently asked questions
Does this make AI coding tamper-proof?
No. A local administrator can still alter system-managed files. Strong enforcement depends on users not having local administrative rights or on distributing policy through MDM, Group Policy or another centrally managed control plane.
Why is native Windows treated differently?
It has managed permission deny rules, but no equivalent native OS sandbox for Bash. WSL2 is the stronger option when an OS-enforced sandbox is a requirement.