Last checked: 21 Oct 2026. The vendor facts below come from Anthropic's Claude Code documentation, OpenAI's Codex documentation and Cursor's documentation, with independent evidence from Google's DORA research, the NCSC, OWASP, Meta, an arXiv study and published CVE records.
A written AI coding policy governs nothing until something on the developer's machine or in the admin console carries it out. Sort engineering work into tiers by what could go wrong, then give each line of the policy the lightest control that really enforces it: instructions for conventions, hooks for checks that must run every time, and admin settings, the sandbox and network scope wherever a wrong action would matter. Claude Code, Codex and Cursor all offer these layers, and all three document their limits.
This post is for engineering teams using coding agents. For Claude Skills used by business teams, see how to roll out and govern Claude Skills. If the policy itself is not written yet, start with our AI policy template.
Three kinds of control
Instructions suit conventions
Anthropic says Claude treats CLAUDE.md files "as context, not enforced configuration", and points to a PreToolUse hook for blocking an action regardless of what Claude decides (Claude Code memory docs). Codex assembles AGENTS.md files into its prompt at startup, with nearer files overriding earlier ones, up to 32 KiB by default (Codex AGENTS.md docs). Cursor lets Team and Enterprise admins make a Team Rule required, and its own rules page says "AI guidance should not be your only security control" (Cursor rules docs).
Instructions are followed in ordinary work. A 2026 study of agents including Claude Code and Codex found that "instructions in context files are generally followed", although the files did not generally improve task success and raised inference cost by over 20% on average (arXiv 2602.11988, v3, 29 Sep 2026). It tested cooperative tasks only. The NCSC explains why that is not enough for security: current models "simply do not enforce a security boundary between instructions and data", so it advises "deterministic (non-LLM) safeguards that constrain the actions of the system" (NCSC, 8 Dec 2025).
Hooks run every time, once you set the failure mode
Anthropic describes Claude Code hooks as "deterministic control", and a PreToolUse deny holds even in bypassPermissions mode (Claude Code hooks guide). But a hook that crashes lets the action proceed on most events, so a policy hook needs exit code 2 and, from v2.1.295, "onFailure": "block" (hooks reference). For a hard allow or deny, Anthropic says to use the permission system rather than a hook.
OpenAI tells Codex administrators to "Treat tool hooks as a useful guardrail, not a complete enforcement boundary". Managed hooks cannot be disabled by users, but Codex does not distribute the scripts, so your own tooling installs them (Codex hooks docs). Its security cookbook warns that "errors, timeouts, or malformed hook responses can allow a tool call to proceed" (Codex security cookbook). Cursor hooks fail open by default. Setting failClosed makes failures block the action, and cloud distribution of team hooks is an Enterprise feature (Cursor hooks docs).
In all three tools, write the policy hook to fail closed, test what happens when it breaks, and back it with the layer below. Our guide to rules, skills, subagents and hooks covers the mechanics.
Admin settings, the sandbox and network scope limit access
Claude Code permission rules match command text, which Anthropic says "isn't a security boundary around the program" (Claude Code permissions). Its OS-enforced sandbox covers shell commands only, runs commands unsandboxed on native Windows, and falls back to running without the sandbox if it cannot start unless sandbox.failIfUnavailable is set (Claude Code sandboxing). Denying the fetch tool does not stop curl. The sandbox network allowlist does (Claude Code admin setup).
Codex runs with network access off by default (Codex approvals and security), and admins can block full-access sandbox mode and --yolo (Codex managed configuration). Its command rules are experimental, and OpenAI says they should be paired with sandboxing, least-privilege accounts, network restrictions, cloud IAM, branch protection and deployment approvals (Codex rules).
Cursor calls its command allowlist "best-effort, not a security boundary" and states that "There is no security boundary between agents and your user account" (Cursor LLM safety and controls). Cloud agents run on their own machine, outside Run Modes (Cursor Run Modes), and the repository blocklist does not apply to Cloud Agents, Automations or Bugbot (Cursor model and integration management).
Anthropic's Deputy CISO, Jason Clinton, puts the principle this way: "draw the boundary around access and actions, not around a model's instructions" (Anthropic, 21 Jul 2026). OpenAI advises running Codex "under a separate, lower-privilege identity or in an environment that cannot access or obtain production write credentials" (Codex security cookbook).
Sort the work into tiers before choosing controls
One set of rules for every repository is too loose for production and too tight for a prototype. DORA warns that unclear rules leave developers "acting too conservatively out of fear they will cross an invisible line, or acting too permissively and using unvetted tools that introduce significant risk", and recommends three buckets: Prohibited, Permitted with guardrails, and Allowed (DORA). Its 2025 report, from a survey of 4,867 respondents, found with a high degree of certainty that AI's benefits depend on a clear and communicated AI stance (DORA 2025 report).
Anthropic says of its own engineering: "We tier our codebase by risk, and make deliberate decisions on what parts to automate." Meta's "Agents Rule of Two" gives a test: in one session an agent should have no more than two of untrustworthy inputs, access to sensitive systems or private data, and the ability to change state or communicate externally. If it needs all three, it requires supervision (Meta, 31 Oct 2025).
No coding tool vendor publishes a tier model. These tiers are our own suggestion.
| Tier | Typical work | Controls that should carry it |
|---|---|---|
| 1. Experiments | Prototypes and sandbox repositories with no customer data or production credentials | Company accounts only, a network allowlist, instructions for conventions |
| 2. Internal tools and product code | Most day-to-day engineering | Managed settings, required team rules, fail-closed hooks for secret scanning and protected paths, the sandbox on, a minimum client version |
| 3. Regulated or customer-facing production | Payment flows, customer data, infrastructure | A separate lower-privilege identity, no production write credentials in reach, a person approving pushes and migrations, activity records kept outside the tool |
Applying different rules per tier in each tool
Claude Code. Admin console settings "apply uniformly to all users in the organization. Per-group configurations are not yet supported" (server-managed settings). Developers can add to managed allow and deny lists but not remove from them (admin setup), so a tier 3 repository can carry stricter settings. Otherwise, tiering means separate environments or, in our reading, different managed settings per device group through device management.
Codex. Overrides let specific users, groups or roles have different settings, but "A workspace role or group alone does not enforce a local runtime restriction", and a changed policy may not reach a running task immediately (Codex managed configuration).
Cursor. Enterprise Organisation Groups resolve overlaps "toward the most permissive result", so Cursor advises strict defaults at team level and groups to widen access (Cursor Organisation Groups). Set your strictest common tier as the default and widen it for experiments. For the regulated case, see Cursor in regulated businesses.
The controls side by side
Plan availability changes often, so check each vendor's page for your plan.
| Control | Claude Code | Codex | Cursor |
|---|---|---|---|
| Instructions | CLAUDE.md is context, and a managed copy always loads | AGENTS.md assembled into the prompt, 32 KiB default | Team Rules can be required |
| Hooks | Fail open unless set to block | A guardrail, and managed hooks cannot be disabled by users | Fail open by default, failClosed available |
| Sandbox and network | OS-enforced for shell commands only | Network off by default | Allowlist is best effort, and cloud agents sit outside Run Modes |
| Admin delivery | Console delivery is client-side, and device management is stronger | Cloud-managed requirements fail closed on load | Most levers on Enterprise, and groups only widen |
| Identity lock | Login method, organisation and provider | Login method and workspace, delivered locally | Personal accounts blocked through device management |
| Activity records | Telemetry, prompts redacted by default | Opt-in telemetry, Compliance API on Enterprise | Audit logs of admin changes only |
| Spend | Depends on how you buy | Depends on sign-in method | Enterprise limits, not instant |
Identity: make the approved route the easy one
Locking out personal accounts only works if the company route is easy to use. DORA found that restrictive internal platforms "often create shadow IT or unofficial workarounds" (DORA 2025 report). It was writing about developer platforms, but the behaviour carries over. A Censuswide survey of 2,003 UK employees, commissioned by Microsoft, found 71% had used unapproved consumer AI tools at work and 28% said their company offered no approved option (Microsoft UK, Oct 2025). That covers all employees, and Microsoft sells its own assistant.
The data terms matter too. Anthropic trains on Free, Pro and Max accounts when the setting is on, including Claude Code use from them, but not on code or prompts sent under commercial terms unless the customer opts in (Claude Code data usage). Check the other vendors' terms separately.
- Claude Code can force logins to your organisation with
forceLoginMethodandforceLoginOrgUUID, and refuse other providers withallowedProviders(Claude Code authentication). - Codex logs users out if credentials do not match configured restrictions, and those restrictions "must be delivered locally or through macOS MDM" (Codex authentication).
- Cursor calls the policy blocking personal accounts on corporate devices its most important MDM policy (Cursor identity and access management).
Each lock binds one tool. Anthropic says "managed settings bind Claude Code only" (Claude Code managed settings), so network policy and endpoint controls cover the rest. To find what is already in use, run a shadow AI audit first.
Activity records: what each tool captures
None of the three gives you a record of every prompt and command by default.
- Claude Code emits OpenTelemetry with prompt text redacted by default, and a developer's setting can still disable a signal (Claude Code monitoring). For request-level audit, Anthropic recommends a gateway (admin setup).
- Codex telemetry is off by default. The Compliance API is listed for Enterprise only (Codex pricing), and OpenAI says "Do not promise that Codex telemetry captures every command argument, output byte, or network packet" (security cookbook).
- Cursor audit logs are on Enterprise and record administrative changes, "never prompts, agent output, generated code, or credentials". Cursor says to use hooks to log development activity (Cursor compliance and monitoring).
OWASP notes that logging "will not prevent Excessive Agency, but can limit the level of damage caused" (OWASP). Decide what a tier 3 investigation would need, then check which layer records it.
Spend controls depend on how you buy
Claude Code spend limits can be set at organisation, group or member level on Teams and Enterprise, while cloud-provider usage falls under the cloud's own budgets (Claude Code costs). Codex workspace limits "don't cover all Codex usage or govern OpenAI API Platform billing" (Codex usage limits), so the sign-in lock above doubles as a spend control. Cursor warns that "Enforcement is not instant, so usage can briefly exceed your spend limit" (Cursor spend limits). Our post on Cursor spend controls covers the detail.
Keep the controls current
All three tools have had vulnerabilities, since fixed, where a repository's own files could run code or be loaded without the developer's approval, including CVE-2025-59536 in Claude Code, CVE-2025-61260 in the Codex CLI and CVE-2025-54135 in Cursor. Enforce a minimum client version (Claude Code supports requiredMinimumVersion, per the settings reference) and be deliberate about trusting project configuration.
We recommend piloting each control on one machine, then after every change run one action that should be allowed and one that should be blocked on each tier. Re-check vendor docs monthly. For Claude Code setup steps, see setting up Claude Code safely for a business team.
Common questions
Is a CLAUDE.md or AGENTS.md file enough to stop an AI coding agent doing something risky?
No. Anthropic describes CLAUDE.md as context rather than enforced configuration. A 2026 study found instructions in context files are generally followed, which suits conventions, but it tested ordinary tasks and not hostile input. Use hooks, admin settings and the sandbox for anything that must not happen.
Do hooks reliably block a risky action?
A hook that returns a block runs every time, but Claude Code and Cursor hooks fail open by default when the hook itself breaks, and OpenAI calls Codex hooks a guardrail rather than a complete enforcement boundary. Set the failure mode to block and pair hooks with sandbox, network and device controls.
Can we use different rules for a sandbox project and a regulated production codebase?
Yes, but the mechanism differs. Claude Code admin console settings apply to everyone today, so tiering relies on stricter repository settings or separate environments. Codex supports overrides for users, groups and roles. Cursor Enterprise groups can only widen access, so set the strict tier as the team default.
What do the activity records for Claude Code, Codex and Cursor actually capture?
Less than a complete record. Cursor audit logs record administrative changes, never prompts or generated code. Claude Code telemetry redacts prompt text by default. Codex telemetry is off by default, and OpenAI tells customers not to promise a complete record of every command.
How do we stop developers using personal accounts or unmanaged tools?
Provide an approved route that is easy to use, then lock the alternatives. Each tool can force sign-in to your organisation, and for Codex and Cursor that lock is delivered to the device. Each lock covers one vendor's tool only, so network and endpoint controls cover the rest.
If you want help turning your policy into controls across the tools your engineers already use, start with a diagnostic, or see our AI implementation services and Request a Quote. We also cover each tool through our Claude, OpenAI and Cursor and Grok implementation services.
Get new articles by email
Practical guides from the SpotDev team, when we publish them.
By submitting this form, you consent to us sending you emails with our latest content. Privacy Policy
