Claude Code governance guidance

Reviewed 3 October 2026. Aicura is not affiliated with Anthropic.

About Claude Code

Claude Code is an AI coding agent that reads, writes and runs code across a developer’s repositories, working in the terminal, in the IDE, in a desktop app and in cloud sessions. Its reach grows quickly. It starts by drafting and explaining code, then edits files and runs commands on the developer’s machine, connects to outside tools and data through extensions and can carry long pieces of work forward with little or no step-by-step approval. Good governance lets an organisation hand it more of the work with confidence, because what it can touch, what it can run and what it sends out are decided rather than left to each developer.

Where governance makes the difference

• Actions running beyond what was intended. Claude Code can run commands with whatever access the developer’s account holds. Without agreed limits on what runs unattended, a single misjudged step can change systems, data or credentials well outside the task at hand.
• Content steering the agent. Claude Code reads repository files, web pages, issues and tool output as it works. Instructions hidden in that content can influence what it does, including where it sends code or secrets.
• Extensions and accounts nobody approved. Developers can connect extensions, add plugins and sign in with personal accounts. Each one can widen what Claude Code reaches or move work outside the arrangements the organisation agreed with the vendor.

---

For the executive team

The value comes from letting it act, so the limits need to be agreed

Claude Code earns its keep when developers let it do real work rather than approve every step. That is a business decision about how much independence a coding agent gets and where. Agreeing those limits once, at the organisation level, lets teams move faster without each developer drawing the line differently.

Source code and credentials are the assets at stake

The organisation’s code, the secrets around it and the systems it deploys to are what Claude Code works with every day. Leadership needs to know that this material stays within agreed arrangements and that nothing reaches production without the same review a person’s work would get.

Someone needs to own it across the engineering estate

Claude Code tends to spread team by team through individual sign-ups. A named executive owner, a technical owner and a clear rule on which accounts are approved turn scattered adoption into a managed capability.

Oversight needs to keep pace with change

New extensions, new ways of running the agent unattended and changes to the underlying AI arrive often. The setup approved at rollout will not be the one running six months later, so oversight works best as a standing practice rather than a one-off sign-off.

Questions worth putting to management

• Who is accountable for Claude Code, and how many developers are using it today on approved accounts?
• What is Claude Code allowed to do without a person approving each step, and who decided that?
• Which extensions and outside tools is it connected to, and who approved them?
• How is code written by Claude Code reviewed before it reaches production?
• How would the organisation know if Claude Code ran something it should not have, or sent code somewhere it should not go?
• If a customer or insurer asked how AI coding tools are governed, what would be shown to them?

What good reporting looks like

Expect regular reporting on adoption and spend by team, the limits in force and any changes to them, extensions approved or refused, notable events such as blocked actions or unusual activity and the significant decisions taken, with who made them and why.

How Aicura can help

• One register showing Claude Code, the teams using it, who owns it and the extensions and AI it relies on, with use outside approved accounts brought to light.
• Board reporting drafted from the governance record, covering adoption, spend, limits, events and the decisions taken.
• Every approval and control action recorded as it happens, so the organisation can show customers and insurers how its AI coding tools are governed.

---

For risk, compliance and assurance

Set where Claude Code sits in the risk appetite

Decide which repositories and environments Claude Code may work in and how much it may do there without a person approving each step. Repositories holding regulated data, payment logic or security controls may warrant tighter limits than internal tools. Decide too whether unattended runs, such as background or pipeline use, are allowed and under what conditions.

Assess the deployment and its extensions separately

Assess Claude Code as a whole before broad rollout, covering the repositories it reaches, the commands it may run, the accounts and AI provider in use and how its output is reviewed. Assess each extension and connected tool on its own terms, covering what it reads, what it can change, who operates it and whether it brings outside content into the agent’s work.

Reassess when anything changes

A new extension, a looser limit on unattended actions, a new way of running the agent or a change to the underlying AI each move the deployment away from what was assessed. Each needs to trigger a fresh assessment rather than wait for the annual cycle.

Make the data decisions explicitly

Decide which AI provider route Claude Code uses, since the choice of the vendor’s own service or a cloud platform affects billing, data handling and which features are available. Decide how long session records are kept, both with the vendor and on developer machines, and whether detailed records of prompts and tool activity are collected for monitoring, who may see them and for what purpose. Let developers know what is recorded.

Confirm which protections apply

Check which accounts and plans carry the vendor’s commercial data commitments and which retention options are available to the organisation. Use on personal or consumer accounts sits outside those arrangements, so find it and bring it into the approved setup.

Set limits and name who acts

Agree the limits that matter, such as attempts to run blocked commands, connections to unapproved extensions, unusual spend or activity outside working patterns, and name the person who acts when one is crossed.

Keep human review on what ships

Code produced by Claude Code needs to pass the same review, testing and approval as any other change before it reaches production. Make that expectation part of policy and confirm it holds in practice, particularly where the agent opens changes on its own.

Be ready to show governance to others

• Policy. Maintain an AI use policy that covers Claude Code specifically, including approved accounts, where it may act unattended, which extensions are allowed and how its code is reviewed. Tie each commitment to the control that carries it out.
• Accountability. Record decisions on limits and extensions with their reasons when they are made. Have owners confirm periodically that the deployment still matches what was approved.
• Operating evidence. Keep records that controls actually ran, such as limits in force on managed machines, extension approvals, code reviews completed and blocked actions.
• External scrutiny. Prepare for internal and external audit, certification against standards such as ISO/IEC 42001 and insurer questions about AI in the software supply chain.
• Customers and partners. Due diligence questionnaires increasingly ask whether AI tools touch customer code or data. Have the Claude Code answer ready and supported by evidence.
• Incidents. Be able to reconstruct which session, which commands, which extensions and which limits were in place when something went wrong.

How Aicura can help

• Risk and impact assessments for Claude Code and its extensions that run again whenever the deployment changes, feeding a managed set of risks and controls that can mirror to the GRC platform.
• Requests for new extensions or looser limits routed to the right approvers, with committee decisions and owner attestations recorded against them.
• Limits on activity and spend with responses the organisation chooses, from alerting the owner to tightening the agent’s restrictions.
• Every decision and control action kept as evidence that a third party can verify without relying on the organisation’s word.

---

For technology and security

Discover every form Claude Code takes

Inventory Claude Code across the terminal, IDE extensions, the desktop app, cloud sessions, pipeline and automation use and anything built on its SDK. Record which accounts and AI provider each team uses, the AI it runs on and the extensions connected to it. Device telemetry and code repositories show where it is installed and configured but not yet recorded.

Bring every machine under managed settings

Claude Code applies settings delivered by the organisation above anything a developer or project sets. Deliver them through device management or the vendor’s admin console to restrict login to the organisation’s own accounts, limit which AI providers and models may be used, keep the agent within an approved version range and set the default level of independence. Treat those settings as code, keep them in source control and run a preflight check on every change before it reaches devices.

Contain what the agent can run

Use permission rules to allow, ask about or deny specific tools and commands, and turn on sandboxing so commands run with filesystem and network limits enforced by the operating system. Permission rules alone do not stop a permitted shell command from reaching the network, so pair them with the sandbox. Keep the most independent modes for isolated environments such as containers or disposable machines.

Put repository configuration under change control

Project settings, extension definitions and agent instructions live in the repository alongside the code. Review them like any other change and run a preflight check in the pipeline, so a new extension, a broader permission or a changed instruction is checked against agreed rules before developers pick it up.

Control which extensions can connect

By default developers can connect any extension they choose. Decide on a pattern, from a fixed approved set to an allowlist, and enforce it through managed settings, matching extensions by address or command rather than by name. Restrict plugin sources the same way and limit who can add new ones.

Govern model traffic in the request path

Claude Code can send its model calls through an AI gateway the organisation runs, using a documented model API, and managed settings can make that gateway the only destination a machine may use. That makes it possible to redact secrets and personal information before they leave, screen inbound content for injected instructions, limit models, cap spend per developer or team and cut off access when needed.

Use the network and environment settings for what the gateway cannot reach

Cloud sessions run in vendor-managed environments with their own network access settings, and other vendor traffic from the device follows its own protocol. Set cloud environment network access to the minimum each team needs, consider self-hosted environments where code must stay on the organisation’s infrastructure and use the network edge on managed devices to allow the approved setup and steer people away from unapproved routes.

Feed everything Claude Code exposes into monitoring

Claude Code can export metrics, events and traces through OpenTelemetry, including tool decisions, extension use and cost, with fuller prompt and tool detail available where the organisation chooses to collect it. Set the exporter through managed settings so developers cannot redirect it, bring it together with usage reporting and vendor activity records and apply the limits risk has agreed, with responses from alerting the owner to tightening restrictions.

Test against the live setup

Run red-teaming and agent evals against Claude Code as it is actually configured, with the real permission rules, sandbox and extensions, including content seeded with injected instructions. Repeat on a schedule and after configuration changes, and watch for changes in behaviour between runs.

How Aicura can help

• One inventory of Claude Code, the AI it runs on, the extensions and identities behind it, with discovery from device telemetry and code repositories of installs not yet recorded.
• Preflight checks in the pipeline before a managed settings change, a new extension or a new model goes live.
• A gateway in the request path for Claude Code model traffic, with guardrails derived from the agreed controls covering redaction, injection screening, model limits, budgets and the ability to cut off access.
• A collector inside the network for Claude Code telemetry that flags undeclared tool use and holds readings against agreed limits, plus scheduled red-teaming and agent evals against the live setup.

---

Getting lasting value from Claude Code

Claude Code pays off when it is governed as an ongoing practice rather than approved once at rollout. Three things matter whatever the role. The first is knowing every place it is in use, on which accounts and with which extensions, and who is accountable for it. The second is setting and enforcing limits on what it can run, reach and send, and keeping those limits in step as the agent is given more independence. The third is being able to show, at any time, how decisions were made and that controls held. Organisations that get these right can hand Claude Code more of the work, with confidence rather than caution.

---

Sources

• Anthropic, Claude Code product page
• Claude Code Docs, Security
• Claude Code Docs, Authentication
• Claude Code Docs, Set up Claude Code for your organization
• Claude Code Docs, Control MCP server access for your organization
• Claude Code Docs, Other LLM gateways
• Claude Code Docs, Monitoring
• Claude Code Docs, Data usage