Govern Claude Code

Control level

Claude Code reads a managed settings file from an operating system location that users cannot override. Govern compiles the agent policy into that file, and the endpoint agent installs it.

1. Write the policy

Write rules in Agent policy; see Agent policy.

2. Enrol the machine

Install and enrol the endpoint agent (keystone-agent) on the developer's machine; see Deploy. The agent fetches the policy compiled for the claude-code engine, verifies its signature and installs managed-settings.json at:

The agent owns this file and removes it when it is uninstalled.

3. What the managed settings contain

• permissions.allow, permissions.ask and permissions.deny from the rules Claude Code can express, with defaultMode: "default".
• disableBypassPermissionsMode: "disable" and disableAutoMode: "disable", so an ask reaches a person, not a classifier.
• allowManagedPermissionRulesOnly: true and allowManagedHooksOnly: true, so user and project settings cannot add allow rules or hooks.
• A PreToolUse hook with matcher * that runs keystone-agent policy enforce --engine claude-code, which enforces the rules Claude Code cannot express itself, and one entry per organisation-approved hook.

A revoked policy denies every tool by name and *.

4. Check the preview

Open Agent policy > Policy preview, choose the person, the project and the engine claude-code, and read the gaps. Gaps are enforced only where the endpoint agent runs.

5. Route model traffic through the gateway

Open Models > Connect a coding tool for the values of your deployment. The settings, for ~/.claude/settings.json or the managed settings file:

{
  "apiKeyHelper": "keystone-cli token models --tool claude_code",
  "env": {
    "ANTHROPIC_BASE_URL": "<your API URL>/api/v1/models/gateway",
    "CLAUDE_CODE_API_KEY_HELPER_TTL_MS": "900000"
  }
}

1. Install the keystone-cli your administrator provides and put it on PATH.
2. Give it a credential: set KEYSTONE_URL and either enrol the machine with the endpoint agent or export KEYSTONE_TOKEN.
3. Check it: keystone-cli token models --tool claude_code prints a token starting with nigw_.
4. Write the settings above, or deploy them as managed settings with your device management tool.
5. Start Claude Code. Its requests appear in Models > Request logs under the person's name.

Claude Code runs the credential command itself and refreshes the short-lived token every 15 minutes and on any 401. Deployed as managed settings, the base URL and credential helper cannot be changed in Claude Code, but other clients and keys can still reach Anthropic unless your network blocks them.

Claude Code session controls

The AI tool controls service (marked beta in the console) has Claude Code pages: Claude Code (sessions), Claude Code policy, Claude Code managed settings, and Claude Code pauses and stops. Sessions can be killed, paused and resumed (/api/v1/claude/sessions/{id}/kill, /pause, /resume), and tool policies and MCP allow and deny rules (/api/v1/claude/tool-policies, /api/v1/claude/mcp-rules) are managed there. Changes need controls:manage; reading sessions needs security:read.

The Claude Code managed settings page generates a separate managed-settings.json from these tool policies and MCP rules, for devices without the endpoint agent. Its hooks send each tool call to the endpoint agent, or, without the agent, to Govern with the person's own key in KEYSTONE_HOOK_TOKEN; a tool call neither decides is refused. Tool policies only narrow what agent policy allows: agent policy is authoritative.

Audit

Claude Code can push OpenTelemetry events to Govern's vendor audit receiver; see Evidence. Policy decisions are in Agent decisions, and hook decisions in AI tool decisions.