the short answer
Each agent has its own file, format and precedence. Claude Code reads managed-settings.json, Codex reads requirements.toml, Cursor reads an enterprise hooks.json and permissions.json, Copilot CLI reads policy.d hooks and an enterprise managed-settings.json, and Gemini CLI reads a system settings.json plus admin TOML policies. Admins running several agents maintain several schemas, or put one policy engine behind the ones it supports.
- Agents covered
- Claude Code, Codex, Cursor, Copilot CLI, Gemini CLI
- Formats
- JSON, TOML, JSON hooks, TOML policies
- Shared idea
- A system path or MDM key, plus agent-specific precedence
- Differences
- Precedence, hook events, failure defaults
- Failproof coverage
- Claude Code, Codex, Cursor and Copilot CLI; not Gemini CLI
Files and Delivery
| Agent | Admin file | MDM / registry / other | Format |
|---|---|---|---|
| Claude Code | /Library/Application Support/ClaudeCode/managed-settings.json; /etc/claude-code/managed-settings.json; C:\Program Files\ClaudeCode\managed-settings.json | com.anthropic.claudecode; HKLM\SOFTWARE\Policies\ClaudeCode (Settings value); server-managed console | JSON |
| OpenAI Codex | /etc/codex/requirements.toml; %ProgramData%\OpenAI\Codex\requirements.toml | com.openai.codex key requirements_toml_base64; cloud requirements | TOML |
| Cursor | /Library/Application Support/Cursor/hooks.json; /etc/cursor/hooks.json; C:\ProgramData\Cursor\hooks.json; ~/.cursor/permissions.json (user-writable) | Configuration profile or Group Policy for app policies; team dashboard | JSON |
| GitHub Copilot CLI | /etc/github-copilot/policy.d/*.json; /Library/Application Support/GitHubCopilot/managed-settings.json; /etc/github-copilot/managed-settings.json | HKLM\Software\Policies\GitHub\Copilot (policy hooks); com.github.copilot, HKLM\SOFTWARE\Policies\GitHubCopilot (managed settings); .github-private repo | JSON |
| Gemini CLI | System settings.json (/etc/gemini-cli/, /Library/Application Support/GeminiCli/, C:\ProgramData\gemini-cli\); admin policies in the policies folder beside it | Path overridable with the GEMINI_CLI_SYSTEM_SETTINGS_PATH environment variable | JSON + TOML |
What Each Can Enforce
| Agent | Disable bypass/yolo | Command rules | MCP allowlist | Admin hooks |
|---|---|---|---|---|
| Claude Code | disableBypassPermissionsMode | permissions.deny (text match) | allowManagedMcpServersOnly + allowedMcpServers | Managed hooks; allowManagedHooksOnly |
| Codex | allowed_approval_policies plus permission profiles or sandbox modes | [rules] prefix_rules (forbidden or prompt) | [mcp_servers.<name>] identity | allow_managed_hooks_only + [hooks] |
| Cursor | Run Mode team policy | Hooks (terminalAllowlist only controls auto-run) | Dashboard MCP allowlist; mcpAllowlist for auto-run | Enterprise hooks.json, team hooks |
| Copilot CLI | disableBypassPermissionsMode | permissions.deny; policy hooks | allowedMcpServers | policy.d (cannot be disabled) |
| Gemini CLI | security.disableYoloMode | Admin policy engine TOML rules | mcp.allowed plus system mcpServers | hooks (for example BeforeTool) in system settings.json |
What Happens When a Hook Fails
| Agent | Hook crash or timeout |
|---|---|
| Claude Code | Exit 2 blocks; crashes, other exits and timeouts proceed unless the hook sets "onFailure": "block" (2.1.295+) |
| Codex | A deny decision or exit 2 blocks; an unsupported ask fails the hook and the call continues; local crash and timeout behavior is not documented |
| Cursor | Crashes, timeouts and non-2 exits fail open unless failClosed: true |
| Copilot CLI | Crashes and non-zero exits deny; timeouts always fail open |
| Failproof (supported agents) | Denies when its daemon is unreachable or version-mismatched, and narrowly when a declared pack will not load; pair it with each agent’s fail-closed setting so the agent does not fail open on a hook timeout |
Or One Policy Behind the Agents It Supports
Each file above is worth deploying for the controls only that agent can apply: login pinning, MCP, bypass modes. For rules that must hold everywhere, such as no terraform destroy, no .env reads, no push to main, maintain them once in a policy engine. Failproof hooks Claude Code, Codex, Cursor and Copilot CLI among its twelve supported harnesses; it does not hook Gemini CLI. See one policy for Claude Code, Codex, Cursor and Copilot.
FAQ
Which agent has the strongest admin controls?
It depends on the control. Copilot policy hooks cannot be disabled; Codex requirements are explicitly limits users cannot override; Claude Code has the broadest key set. None covers the others.
Do any of these read each other’s configuration?
Mostly not. Cursor can load hooks from Claude Code, and Copilot accepts Claude-format PreToolUse hooks and Bash(...) as an alias for Shell(...), so the same hook can run twice. Check for duplicates.
How often do these change?
Monthly. Several keys in this table were added in 2026. Re-verify before a rollout.
Sources
Checked against the sources below on October 21, 2026. Harness settings, hook capabilities and cloud features change between versions.
- Claude Code docs: Deploy managed settings
- Claude Code docs: Hooks reference
- OpenAI Codex docs: Managed configuration
- OpenAI Codex docs: Hooks
- Cursor docs: Hooks
- Cursor docs: Enterprise deployment patterns
- GitHub docs: Copilot hooks reference
- GitHub docs: Enterprise managed settings for Copilot
- Gemini CLI docs: Enterprise configuration
- Gemini CLI docs: Policy engine
- Failproof AI docs: Agent harnesses and enforcement capability
- Failproof AI docs: Failure behavior