---
title: "Enforce the team's agent settings · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/managed-agent-settings
id: AID-33
level: Recommended
applies: team
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1143
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Enforce the team's agent settings centrally

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Agent config supply chain](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AID-33
- Level: Recommended
- Chapter: [Agent config supply chain](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain.md)
- Rule: When a team shares a coding agent, push its security settings to every machine as managed settings. No user or repository can override them.
- Check: On a staff machine, start the agent with its bypass flag and add an unlisted tool server in a personal settings file. The bypass is refused, the server does not load, and the agent's status shows the managed policy as a source.
- Applies when: The project has two or more developers.
- How: A committed project file guides the team, but anyone can loosen it in a personal file. Most agent tools accept a policy from an administrator, through a system file, device management or the vendor's admin console. Put the parts that protect the company there. Turn off the unattended mode, list the allowed tool servers and plugin sources, and deny reads of secret files. Turn on the sandbox and fix its allowed hosts. Keep personal taste, such as the model or the theme, out of the policy. Unattended runs then happen only as [Skip approvals only in a throwaway sandbox](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/unattended-only-in-sandbox.md) describes.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JSON example

```json
{
  "permissions": {
    "deny": ["Read(./.env)", "Read(./secrets/**)"],
    "disableBypassPermissionsMode": "disable"
  },
  "allowManagedPermissionRulesOnly": true,
  "allowedMcpServers": [{ "serverUrl": "https://mcp.example.com/*" }],
  "allowManagedMcpServersOnly": true,
  "strictKnownMarketplaces": [{ "source": "github", "repo": "example-shop/approved-plugins" }],
  "sandbox": {
    "enabled": true,
    "failIfUnavailable": true,
    "network": { "allowedDomains": ["registry.npmjs.org"], "allowManagedDomainsOnly": true }
  }
}
```

### TOML example

```toml
# requirements.toml for Codex, set by an administrator
allowed_approval_policies = ["untrusted", "on-request"]
allowed_sandbox_modes = ["read-only", "workspace-write"]
```

## Sources

- [Claude Code settings files and precedence](https://code.claude.com/docs/en/settings)
- [Claude Code example settings files](https://code.claude.com/docs/en/settings-example)

## Related rules

- AID-73 [Allow agent network traffic only to listed hosts](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/egress-allow-list.md) in AI-assisted development
- AID-24 [Skip approvals only in a throwaway sandbox](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/unattended-only-in-sandbox.md) in AI-assisted development
- AID-74 [Allow only listed MCP servers and pin each one to an exact version](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/mcp-server-allow-list.md) in AI-assisted development
- AID-68 [Attribute the cost of every agent session](https://agentwranglers.se/playbook/ai-assisted-development/running-agents-at-scale/agent-cost-attribution.md) in AI-assisted development

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/managed-agent-settings">Agent Wranglers AI-assisted development playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Open unknown repositories in a sandbox](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/untrusted-repositories.md)
- Next: [Allow only listed MCP servers and pin each one to an exact version](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain/mcp-server-allow-list.md)
- [Agent config supply chain](https://agentwranglers.se/playbook/ai-assisted-development/agent-config-supply-chain.md)