claude code managed settings template

The Baseline

Replace the org UUID, MCP servers, collector endpoint and binary path (which failproofai on a managed machine). "onFailure": "block" (Claude Code 2.1.295+) makes the hook fail closed: without it, a crashing, missing or timed-out hook lets the tool call through. The version floor is set to the newest version any key here needs.

The hook command is the form failproofai config writes into ~/.claude/settings.json. Registering it in managed settings is your configuration, not a documented Failproof install path. The template locks only the pre-tool gate: keep the user-scope install from failproofai config, which also registers PostToolUse (the default sanitize-* output redaction), Stop (the require-*-before-stop checks), UserPromptSubmit and session events. With both present, the pre-tool check runs twice per call; talk to us about a managed deployment that registers it once.

{
  "permissions": {
    "disableBypassPermissionsMode": "disable",
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./secrets/**)",
      "Read(~/.aws/credentials)",
      "Read(~/.ssh/**)"
    ]
  },
  "disableAutoMode": "disable",
  "allowManagedPermissionRulesOnly": true,
  "allowManagedMcpServersOnly": true,
  "allowedMcpServers": [
    { "serverUrl": "https://api.githubcopilot.com/*" },
    { "serverUrl": "https://mcp.internal.example.com/*" },
    { "serverCommand": ["npx", "-y", "@company/mcp-internal"] }
  ],
  "requiredMinimumVersion": "2.1.295",
  "forceLoginMethod": "claudeai",
  "forceLoginOrgUUID": "00000000-0000-0000-0000-000000000000",
  "cleanupPeriodDays": 30,
  "env": {
    "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
    "OTEL_METRICS_EXPORTER": "otlp",
    "OTEL_LOGS_EXPORTER": "otlp",
    "OTEL_EXPORTER_OTLP_PROTOCOL": "http/protobuf",
    "OTEL_EXPORTER_OTLP_ENDPOINT": "https://otel-collector.example.com"
  },
  "hooks": {
    "PreToolUse": [
      { "matcher": "*", "hooks": [{ "type": "command", "command": "/usr/local/bin/failproofai --hook PreToolUse", "onFailure": "block" }] }
    ]
  }
}

About allowManagedHooksOnly

allowManagedHooksOnly: true blocks user, project and local hooks; only managed hooks, Agent SDK hooks and hooks from plugins force-enabled in managed settings run. Failproof’s default install puts its Claude Code hooks at user scope, so turning this key on switches those hooks off. The template registers only PreToolUse, so output redaction, Stop checks and session capture would stop even with the template in place. Only set it once the managed hook is in place and verified, or talk to us about a managed deployment.

What Each Key Does

Path Prefixes Trip People Up

Sandbox paths use normal conventions (/ is absolute), which differs from permission rules. Test each rule on a real machine.

One Managed Source per Fleet

Managed sources rank server-managed, then MDM, then file, then HKCU, and by default ("first-wins") the first source with a policy key wins for most keys. Since v2.1.242 you can set managedSourcesBehavior to "merge". Pick one source, or set merge explicitly, so a console change never silently replaces your file. See managed settings not enforced.

Where It Applies

• On the machine: the terminal CLI, the VS Code and JetBrains extensions, the desktop app’s Code tab and Agent SDK sessions read managed settings.
• Anthropic-hosted cloud sessions do not read a device’s file or MDM profile; their policy has to come from server-managed settings.
• Claude Tag sessions do not receive server-managed settings; Cowork is configured separately.

Optional: Lock the Sandbox On

{
  "sandbox": {
    "enabled": true,
    "failIfUnavailable": true,
    "allowUnsandboxedCommands": false,
    "filesystem": { "denyRead": ["~/.aws/credentials", "~/.ssh"] },
    "network": { "allowManagedDomainsOnly": true, "allowedDomains": ["github.com", "*.npmjs.org"] }
  }
}