Strict Mode Settings for Enterprise Deployments in Claude Code: Complete Security Configuration Guide

Claude Code enterprise deployments can enforce a deny-by-default security posture using the strict settings file located at examples/settings/settings-strict.json, which disables permission bypasses, blocks web tools, and mandates sandboxed Bash execution with explicit approval requirements.

Organizations deploying Claude Code at scale require hardened security boundaries to prevent unauthorized data access and ensure compliance. The anthropics/claude-code repository provides a canonical strict configuration that implements defense-in-depth controls through JSON-based policy enforcement. This guide examines the specific settings that create a locked-down environment suitable for enterprise-wide adoption.

What Are Strict Mode Settings in Claude Code?

Strict mode settings are a collection of deny-by-default security policies defined in a JSON configuration file. These settings reside in examples/settings/settings-strict.json as demonstrated in the repository's examples directory, and are designed to be inherited across an organization's repository hierarchy through managed-settings.json files.

When activated, these controls prevent users from circumventing permission checks, restrict tool access to explicitly allowed functions only, and enforce sandbox isolation for all Bash operations. According to the accompanying README in examples/settings/README.md, this configuration represents the maximum security baseline for production enterprise environments.

Core Security Controls in settings-strict.json

The strict configuration implements granular controls across four primary domains: permission management, tool restrictions, policy governance, and execution sandboxing.

Permission Bypass Prevention

The strict file disables emergency overrides that could otherwise compromise security boundaries:

• permissions.disableBypassPermissionsMode: Set to "disable" to prevent use of the --dangerously-skip-permissions CLI flag. This ensures no user can launch Claude Code while circumventing the permission model entirely.

• allowManagedPermissionRulesOnly: Set to true to enforce that only permission rules defined in Claude Code's managed policy files are honored. When enabled, user-level or project-level allow/ask/deny entries in local settings files are ignored completely.

Tool Access Restrictions

Strict mode implements minimal-access principles for Claude Code's tool suite:

• permissions.ask: Configured as ["Bash"] to permit only the Bash tool to request permission interactively. All other tools default to denial unless explicitly managed elsewhere.

• permissions.deny: Set to ["WebSearch","WebFetch"] to globally block both web-search and web-fetch tools, eliminating uncontrolled external data retrieval and preventing data exfiltration via search queries.

• strictKnownMarketplaces: Defined as an empty array [] to prevent loading plugins from any marketplace other than those explicitly whitelisted. This effectively blocks all external plugin sources by default.

• allowManagedHooksOnly: Set to true to restrict hook execution to only those provided through Claude Code's managed marketplace. Custom user-defined hooks are rejected immediately.

Sandbox Hardening for Bash Execution

The configuration enforces rigorous containment for shell command execution:

• sandbox.autoAllowBashIfSandboxed: Set to false to require explicit approval for Bash commands even when running inside a sandbox. Auto-allow mechanisms are disabled regardless of containerization status.

• sandbox.excludedCommands: Defined as an empty array [] to ensure no Bash commands are exempted from sandbox enforcement. Every command must pass the sandbox policy validation.

• sandbox.enableWeakerNestedSandbox: Set to false to prohibit nested sandboxes from using weaker security guarantees. All nested environments must retain full isolation standards.

• sandbox.network: All sub-fields use restrictive defaults (false, empty arrays, null) to disallow Unix-socket usage, local network binding, and external domain access. This ensures Bash cannot reach the network unless specifically permitted by an additional policy layer.

Enterprise Deployment Configuration

Deploying strict mode requires placing the configuration at the appropriate level in the settings hierarchy to ensure organizational inheritance.

Organization-Level Implementation

Create a managed-settings.json file at the organization root to apply strict mode globally:

{
  "$schema": "https://code.claude.com/schemas/settings.json",
  "include": [
    "./examples/settings/settings-strict.json"
  ]
}

This approach ensures every repository under the organization inherits the security constraints unless explicitly overridden—an action discouraged for security-critical deployments.

Local Override Testing

For validation purposes or specific project needs, you can test sandbox exemptions locally while maintaining other strict controls:

// settings.local.json (per-project, optional)
{
  "sandbox": {
    "excludedCommands": ["ls", "cat"]
  }
}

Note that when allowManagedPermissionRulesOnly is true, such local overrides may be ignored unless the managed policy explicitly permits them.

Configuration Validation

Test the strict configuration locally before enterprise rollout:

# Apply the strict config to a local repository for validation

claude-code apply-settings ./managed-settings.json

# Run a harmless command to verify the permission prompt appears

claude-code run --tool Bash "echo Hello"

Successful validation requires explicit user approval for the Bash command despite its benign nature, confirming that autoAllowBashIfSandboxed is functioning correctly.

Summary

• Strict mode is defined in examples/settings/settings-strict.json and implements a deny-by-default security model for enterprise Claude Code deployments.
• Permission bypass prevention disables the --dangerously-skip-permissions flag and enforces managed-only policy rules via allowManagedPermissionRulesOnly.
• Tool restrictions block WebSearch and WebFetch tools while limiting interactive permission requests to Bash commands only.
• Plugin security requires allowManagedHooksOnly and an empty strictKnownMarketplaces array to prevent unauthorized code execution from external sources.
• Sandbox hardening removes auto-approval for sandboxed Bash commands, eliminates command exemptions, and disables network access, Unix sockets, and weaker nested sandbox configurations.

Frequently Asked Questions

How do I prevent users from bypassing permission checks in enterprise Claude Code deployments?

Set permissions.disableBypassPermissionsMode to "disable" in your strict settings file. This configuration prevents users from launching Claude Code with the --dangerously-skip-permissions flag, ensuring the permission model remains active regardless of CLI arguments.

Can strict mode be overridden by individual project settings?

When allowManagedPermissionRulesOnly is set to true, individual project settings cannot override the managed permission rules. However, without this setting, local settings.local.json files could potentially relax restrictions, which is why enterprise deployments should always enable this managed-only enforcement.

What happens to Bash commands when strict mode sandbox settings are enabled?

Bash commands require explicit user approval for every execution because sandbox.autoAllowBashIfSandboxed is set to false. Additionally, all commands run under full sandbox restrictions with no network access, no Unix socket usage, and no command exemptions unless explicitly defined in managed policies.

Where is the official strict mode configuration template located?

The canonical strict mode template resides at examples/settings/settings-strict.json in the anthropics/claude-code repository, with documentation available in examples/settings/README.md. These files provide the complete JSON schema and explanatory matrix for enterprise security configurations.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}