How to disable --dangerously-skip-permissions for your whole organization

the short answer

Set permissions.disableBypassPermissionsMode to "disable" in Claude Code managed settings, delivered by file or MDM, and verify by launching with the flag on a managed machine. Do the equivalent in other agents: Copilot’s managed settings use the same key, Codex restricts approval policies and sandbox or permission profiles in requirements.toml, and Gemini CLI has security.disableYoloMode. Keep a hook-level policy as a second layer.

Claude Code: permissions.disableBypassPermissionsMode: "disable" (also rejects --dangerously-skip-permissions)
Copilot: permissions.disableBypassPermissionsMode: "disable" (suppresses --yolo, --allow-all*, /yolo)
Codex: allowed_approval_policies plus allowed_permission_profiles (or legacy allowed_sandbox_modes)
Gemini CLI: security.disableYoloMode: true in system settings
Second layer: A PreToolUse policy that fails closed

Claude Code

Put it in managed settings, not user settings. Then verify: on a managed machine run claude --dangerously-skip-permissions and confirm it refuses. Users reported versions where the managed key did not block the flag (#44642, #86253), so test after every upgrade.

{
  "permissions": { "disableBypassPermissionsMode": "disable" },
  "disableAutoMode": "disable"
}

Other Agents

Agent	Setting	Where
GitHub Copilot	`"permissions": { "disableBypassPermissionsMode": "disable" }`; it can be made overridable per enterprise team with `{ "overridable": "disable" }`	Copilot enterprise `managed-settings.json` (`.github-private` repo, file or MDM)
OpenAI Codex	`allowed_approval_policies = ["on-request"]` and an `[allowed_permission_profiles]` table without `":danger-full-access"` (0.138.0+), or legacy `allowed_sandbox_modes` without `danger-full-access`	`/etc/codex/requirements.toml`, `%ProgramData%\OpenAI\Codex\requirements.toml`, or MDM key `requirements_toml_base64`
Gemini CLI	`{ "security": { "disableYoloMode": true } }`	System `settings.json`, e.g. `/etc/gemini-cli/settings.json`
Cursor	Run Mode set by team policy (Auto-review, Allowlist, Run Everything)	Team dashboard; Cursor documents the allowlist as best-effort

Why You Still Want a Second Layer

Bypass mode exists because approval prompts are tiring, and developers find ways back to it. Claude Code runs PreToolUse hooks before the permission prompt for every tool except EndConversation, and hook input reports the current mode (permission_mode: "bypassPermissions"), so a hook-level deny on terraform destroy still applies in bypass mode. Verify that on your version.

The hook must itself fail closed. In Claude Code set "onFailure": "block" (2.1.295+); in Cursor set failClosed: true. Copilot hook timeouts always fail open, even for admin policy hooks, so keep Copilot hook scripts fast.

FAQ

Does disabling bypass mode slow developers down?

It brings back prompts. Pair it with a sensible managed allow list for safe commands so people are not approving ls all day.

Can a developer just edit the managed file?

Only with local admin rights. Redeploy it from MDM on a schedule, and watch for machines that drift.

Do hooks run in bypass mode?

Claude Code documents that PreToolUse hooks run before the permission prompt and that a deny prevents the call; bypass mode removes prompts. Test it on your version.

Sources

Checked against the sources below on October 21, 2026. Harness settings, hook capabilities and cloud features change between versions.