Your developers already gave an AI agent a shell. This is the playbook for governing it.
Claude Code reads your repositories, runs terminal commands, calls MCP servers, and reaches the network, all on a developer's behalf. That makes it a new kind of endpoint, and most security programs have no controls built for it. This book gives security architects, platform engineers, and GRC teams a complete, auditable way to approve AI coding tools without losing control.
What you'll be able to do:
- Model the real threats: prompt injection through repo files and web pages, credential exposure, destructive commands, extension supply chain, and excess autonomy
- Enforce policy fleet-wide with managed settings delivered by MDM or server, fail-closed startup, locked permission modes, and version pinning
- Contain the agent with OS-level sandboxing, filesystem and network allowlists, credential masking, and dev containers
- Lock down the supply chain: MCP servers, plugins, marketplaces, and skills, with a review checklist for every new extension
- Use hooks as enforcement and route traffic through an LLM gateway for identity, spend limits, and egress control
- Detect and respond: OpenTelemetry audit events mapped to 10 SIEM detections, plus an incident response playbook for agent-originated incidents
Ready-to-adapt deliverables: three complete managed-settings baselines (Strict, Standard, Research), a STRIDE threat table, and a control mapping to NIST CSF 2.0, ISO/IEC 27001:2022, and the OWASP Top 10 for LLM Applications.
Every setting is tied to the published Claude Code documentation as of November 2026. No hype or theory, just the controls and how to combine them.
Scroll up and get the playbook your security review is missing.
Independent publication. Not affiliated with, sponsored by, or endorsed by Anthropic. Claude and Claude Code are trademarks of Anthropic, PBC.
