# Strict Mode Settings for Enterprise Deployments in Claude Code: Complete Security Configuration Guide

> Secure your enterprise Claude Code deployments with strict mode settings. Learn how to configure deny-by-default security, block web tools, and mandate sandboxed Bash for maximum protection.

- Repository: [Anthropic/claude-code](https://github.com/anthropics/claude-code)
- Tags: how-to-guide
- Published: 2026-04-02

---

**Claude Code enterprise deployments can enforce a deny-by-default security posture using the strict settings file located at [`examples/settings/settings-strict.json`](https://github.com/anthropics/claude-code/blob/main/examples/settings/settings-strict.json), which disables permission bypasses, blocks web tools, and mandates sandboxed Bash execution with explicit approval requirements.**

Organizations deploying Claude Code at scale require hardened security boundaries to prevent unauthorized data access and ensure compliance. The `anthropics/claude-code` repository provides a canonical strict configuration that implements defense-in-depth controls through JSON-based policy enforcement. This guide examines the specific settings that create a locked-down environment suitable for enterprise-wide adoption.

## What Are Strict Mode Settings in Claude Code?

Strict mode settings are a collection of **deny-by-default** security policies defined in a JSON configuration file. These settings reside in [`examples/settings/settings-strict.json`](https://github.com/anthropics/claude-code/blob/main/examples/settings/settings-strict.json) as demonstrated in the repository's examples directory, and are designed to be inherited across an organization's repository hierarchy through [`managed-settings.json`](https://github.com/anthropics/claude-code/blob/main/managed-settings.json) files.

When activated, these controls prevent users from circumventing permission checks, restrict tool access to explicitly allowed functions only, and enforce sandbox isolation for all Bash operations. According to the accompanying README in [`examples/settings/README.md`](https://github.com/anthropics/claude-code/blob/main/examples/settings/README.md), this configuration represents the maximum security baseline for production enterprise environments.

## Core Security Controls in [`settings-strict.json`](https://github.com/anthropics/claude-code/blob/main/settings-strict.json)

The strict configuration implements granular controls across four primary domains: permission management, tool restrictions, policy governance, and execution sandboxing.

### Permission Bypass Prevention

The strict file disables emergency overrides that could otherwise compromise security boundaries:

- **`permissions.disableBypassPermissionsMode`**: Set to `"disable"` to prevent use of the `--dangerously-skip-permissions` CLI flag. This ensures no user can launch Claude Code while circumventing the permission model entirely.

- **`allowManagedPermissionRulesOnly`**: Set to `true` to enforce that only permission rules defined in Claude Code's managed policy files are honored. When enabled, user-level or project-level `allow/ask/deny` entries in local settings files are ignored completely.

### Tool Access Restrictions

Strict mode implements minimal-access principles for Claude Code's tool suite:

- **`permissions.ask`**: Configured as `["Bash"]` to permit only the **Bash** tool to request permission interactively. All other tools default to denial unless explicitly managed elsewhere.

- **`permissions.deny`**: Set to `["WebSearch","WebFetch"]` to globally block both web-search and web-fetch tools, eliminating uncontrolled external data retrieval and preventing data exfiltration via search queries.

- **`strictKnownMarketplaces`**: Defined as an empty array `[]` to prevent loading plugins from any marketplace other than those explicitly whitelisted. This effectively blocks all external plugin sources by default.

- **`allowManagedHooksOnly`**: Set to `true` to restrict hook execution to only those provided through Claude Code's managed marketplace. Custom user-defined hooks are rejected immediately.

### Sandbox Hardening for Bash Execution

The configuration enforces rigorous containment for shell command execution:

- **`sandbox.autoAllowBashIfSandboxed`**: Set to `false` to require explicit approval for Bash commands even when running inside a sandbox. Auto-allow mechanisms are disabled regardless of containerization status.

- **`sandbox.excludedCommands`**: Defined as an empty array `[]` to ensure no Bash commands are exempted from sandbox enforcement. Every command must pass the sandbox policy validation.

- **`sandbox.enableWeakerNestedSandbox`**: Set to `false` to prohibit nested sandboxes from using weaker security guarantees. All nested environments must retain full isolation standards.

- **`sandbox.network`**: All sub-fields use restrictive defaults (`false`, empty arrays, `null`) to disallow Unix-socket usage, local network binding, and external domain access. This ensures Bash cannot reach the network unless specifically permitted by an additional policy layer.

## Enterprise Deployment Configuration

Deploying strict mode requires placing the configuration at the appropriate level in the settings hierarchy to ensure organizational inheritance.

### Organization-Level Implementation

Create a [`managed-settings.json`](https://github.com/anthropics/claude-code/blob/main/managed-settings.json) file at the organization root to apply strict mode globally:

```json
{
  "$schema": "https://code.claude.com/schemas/settings.json",
  "include": [
    "./examples/settings/settings-strict.json"
  ]
}

```

This approach ensures every repository under the organization inherits the security constraints unless explicitly overridden—an action discouraged for security-critical deployments.

### Local Override Testing

For validation purposes or specific project needs, you can test sandbox exemptions locally while maintaining other strict controls:

```json
// settings.local.json (per-project, optional)
{
  "sandbox": {
    "excludedCommands": ["ls", "cat"]
  }
}

```

Note that when `allowManagedPermissionRulesOnly` is `true`, such local overrides may be ignored unless the managed policy explicitly permits them.

### Configuration Validation

Test the strict configuration locally before enterprise rollout:

```bash

# Apply the strict config to a local repository for validation

claude-code apply-settings ./managed-settings.json

# Run a harmless command to verify the permission prompt appears

claude-code run --tool Bash "echo Hello"

```

Successful validation requires explicit user approval for the Bash command despite its benign nature, confirming that `autoAllowBashIfSandboxed` is functioning correctly.

## Summary

- **Strict mode** is defined in [`examples/settings/settings-strict.json`](https://github.com/anthropics/claude-code/blob/main/examples/settings/settings-strict.json) and implements a deny-by-default security model for enterprise Claude Code deployments.
- **Permission bypass prevention** disables the `--dangerously-skip-permissions` flag and enforces managed-only policy rules via `allowManagedPermissionRulesOnly`.
- **Tool restrictions** block WebSearch and WebFetch tools while limiting interactive permission requests to Bash commands only.
- **Plugin security** requires `allowManagedHooksOnly` and an empty `strictKnownMarketplaces` array to prevent unauthorized code execution from external sources.
- **Sandbox hardening** removes auto-approval for sandboxed Bash commands, eliminates command exemptions, and disables network access, Unix sockets, and weaker nested sandbox configurations.

## Frequently Asked Questions

### How do I prevent users from bypassing permission checks in enterprise Claude Code deployments?

Set `permissions.disableBypassPermissionsMode` to `"disable"` in your strict settings file. This configuration prevents users from launching Claude Code with the `--dangerously-skip-permissions` flag, ensuring the permission model remains active regardless of CLI arguments.

### Can strict mode be overridden by individual project settings?

When `allowManagedPermissionRulesOnly` is set to `true`, individual project settings cannot override the managed permission rules. However, without this setting, local [`settings.local.json`](https://github.com/anthropics/claude-code/blob/main/settings.local.json) files could potentially relax restrictions, which is why enterprise deployments should always enable this managed-only enforcement.

### What happens to Bash commands when strict mode sandbox settings are enabled?

Bash commands require explicit user approval for every execution because `sandbox.autoAllowBashIfSandboxed` is set to `false`. Additionally, all commands run under full sandbox restrictions with no network access, no Unix socket usage, and no command exemptions unless explicitly defined in managed policies.

### Where is the official strict mode configuration template located?

The canonical strict mode template resides at [`examples/settings/settings-strict.json`](https://github.com/anthropics/claude-code/blob/main/examples/settings/settings-strict.json) in the `anthropics/claude-code` repository, with documentation available in [`examples/settings/README.md`](https://github.com/anthropics/claude-code/blob/main/examples/settings/README.md). These files provide the complete JSON schema and explanatory matrix for enterprise security configurations.