AI coding agent admin guide: enforce policies and see what agents do across your org

the short answer

Install a policy client on every developer machine that hooks each coding agent, checks each gated tool call against centrally deployed policies before it runs, and reports sessions and decisions to one console. Policies are code: publish a version, deploy it to machines in observe mode, then enforce. Pair it with each agent’s own admin settings. Developers keep their IDE, terminal and agent of choice; the same rules apply across all of them.

What is enforced: Agent tool calls: shell commands, file reads and writes, MCP and web tool calls
Where: On the developer machine, at the agent’s hook layer
Decisions: deny (block), instruct (continue with guidance), allow
Agents: Claude Code, Codex, Cursor, Copilot CLI and eight more harnesses
Policies: JavaScript or TypeScript; CLI on GitHub under MIT + Commons Clause
Start: npm install -g failproofai

The Problem in One Paragraph

Most platform teams running coding agents have no view of the agents’ tool calls. Global harness settings exist, but agents get around them with bash scripts and SDK calls. A few admins hold broad permissions, on-call permission sets are elevated and long-lived, and a single loose prompt can delete DNS records. Many engineers also use more than one agent. The goal: guardrails on every local agent without forcing an IDE, a terminal or a harness. This hub answers how.

How Enforcement Works

01WriteA policy in code, a pack from the policy hub, or a draft generated from an audit finding.

02Testfp policies test on described events, and a backtest against 30 days of fleet traffic.

03DeployPublish a version and deploy it to machines in observe mode, then enforce.

04EvaluateEach gated tool call is checked on the machine before it runs.

05RecordSessions and decisions reach one console, with alerts on what matters.

Admins deploy policy centrally; every machine evaluates locally before the agent acts.

“How Do I Put Rules on My Team’s Agents?”

Question	Read
Can a company control agents on employee laptops?	Device management vs agent policy
How are other companies doing it?	What teams actually do
Roll out Claude Code to the team safely	Four-week plan
Same rule in Claude Code, Codex, Cursor, Copilot	One policy, every agent
Different rules per team or role	Scopes and personas
Will guardrails slow developers down?	Benchmark results

Several Agents, Subagents and Parallel Agents

Question	Read
Standardize on one agent or allow several?	Multi-agent strategy
Do rules apply to subagents and parallel agents?	What child agents inherit
Where each agent reads admin policy	Side-by-side matrix

“How Do I See What Agents Are Doing on Company Machines?”

Question	Read
What did agents run on developer machines?	Fleet visibility
Which agents are installed on our laptops?	Detection script
Can admins see employees’ prompts?	By vendor
Get alerted when an agent runs something dangerous	Alerts

Audit Logs and Safety, Agent by Agent

Question	Read
Claude Code audit logs	Team vs Enterprise
Claude Code OpenTelemetry for admins	Telemetry setup
Cursor audit logs	What admins can see
Codex audit logs	What admins can see
GitHub Copilot audit logs	What admins can see
Gemini CLI audit logs	What admins can see
Is Claude Code safe for company code?	Data and risks
Is Cursor safe for company code?	Data and risks
Is Codex safe for company code?	Data and risks
Is GitHub Copilot safe for company code?	Data and risks
Is Gemini CLI safe for company code?	Data and risks

“How Do I Make Sure the Rules Are Actually Enforced?”

Question	Read
Are Claude Code managed settings enough?	Limits, from Anthropic’s docs
Our managed settings are not being enforced	Known gaps and fixes
The agent ran the command anyway	Scripts, SDKs, decision models
Can the agent turn its guardrails off?	Tamper resistance
Disable --dangerously-skip-permissions org-wide	Every agent
Hooks vs sandbox vs managed settings	Control layers

Copy-Paste Admin Configs

Question	Read
Claude Code managed-settings.json	Annotated baseline
Codex requirements.toml	Annotated baseline
Cursor enterprise hooks.json	Annotated baseline
Copilot CLI policy hooks	Annotated baseline
MCP server allowlist	Every agent
Deploy with Jamf or Intune	Enrollment script

Stop Specific Disasters

Question	Read
Agent deletes the production database	Policy and credentials
Agent runs terraform destroy	Plan-only policy
Agent deletes DNS records	Route 53 reconstruction
Agent uses an admin AWS profile	Approved profile
On-call shell with production access	Agents diagnose, humans change
Agent reads secret files or leaks keys	Prevent, detect, audit
Block or warn?	Deny vs instruct

Security Review and Compliance

Question	Read
Security review before approving agents	Twenty questions
SOC 2 controls for coding agents	Control mapping
A usage policy you can enforce	Template
Employees on personal AI accounts	Governed path
Policies as code: test, version, share	Lifecycle
Agent incidents	What went wrong

What This Is and Is Not

Each agent’s own hook timeout rules still apply: set onFailure: "block" in Claude Code and failClosed: true in Cursor for hooks that must not fail open, and keep Copilot policy hooks fast, because Copilot timeouts fail open.

It is	It is not
A per-action policy layer for every supported coding agent on every machine	A ban on agents or a mandated IDE
Policies as tested, versioned code	A regex list you hope covers everything
Self-protecting: agents cannot disable or pause it, and it fails closed when its daemon is unreachable	A setting the agent can edit
Sessions and decisions from every machine in one place	A replacement for IAM, SCPs or device management

Try It on One Machine

Then ask your agent to read a .env file or push straight to main, and watch the deny under Policies → Activity. Pattern policies are the fast, deterministic floor; the decision-model checks judge what a call does and whether you asked for it, which holds up against scripts and wrappers a pattern misses. Jev comes with Failproof: turn it on with failproofai jev setup whenever you choose, and we write custom checks for your own rules. For a fleet with central deployment, persona assignment and Slack, book a demo.

npm install -g failproofai
failproofai audit                              # scan existing agent histories offline first
failproofai config                             # hooks every supported agent CLI, installs the daemon
failproofai policies add FailproofAI/policies  # coding agent pack: 10 policies on by default
failproofai policies add FailproofAI/jev-policies  # decision-model checks (Jev comes with Failproof)
failproofai                                    # local dashboard on localhost:8020

FAQ

Where does the code live?

The failproofai CLI and policy packs are on GitHub under an MIT + Commons Clause license. Fleet deployment, telemetry, audits and alerting are Failproof AI Cloud, which can also be self-hosted for Enterprise.

Does it work with Claude Code managed settings?

Yes, and we recommend both. Managed settings lock Claude Code’s own configuration; Failproof holds the policy logic for every supported agent. Note that allowManagedHooksOnly turns off user-scope hooks, including the ones failproofai config installs, unless the Failproof hook is also in managed settings.

Does it slow agents down?

Deterministic policies evaluate locally in the daemon; our engineering write-up measured about 0.7 ms p50. Jev review adds one model call per reviewed call.

Can agents get around it with scripts?

Deterministic rules can be routed around; that is why policies also gate script writes and why decision models judge the call in context. IAM stays the floor.

Sources

Checked against the sources below on October 21, 2026. Harness settings, hook capabilities and cloud features change between versions.