---
title: "Enforce the team's agent settings · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/managed-agent-settings
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Enforce the team's agent settings centrally

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Safety and permissions](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- Level: Recommended
- Chapter: [Safety and permissions](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions)
- Rule: When a team shares a coding agent, push its security settings to every machine as managed settings. No user or repository can override them.
- How: A committed project file guides the team, but anyone can loosen it in a personal file. Most agent tools accept a policy from an administrator, through a system file, device management or the vendor's admin console. Put the parts that protect the company there. Turn off the unattended mode, list the allowed tool servers and plugin sources, and deny reads of secret files. Turn on the sandbox and fix its allowed hosts. Keep personal taste, such as the model or the theme, out of the policy. Unattended runs then happen only as [Skip approvals only in a throwaway sandbox](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/unattended-only-in-sandbox) describes.
- Check: On a staff machine, start the agent with its bypass flag and add an unlisted tool server in a personal settings file. The bypass is refused, the server does not load, and the agent's status shows the managed policy as a source.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JSON example

```json
{
  "permissions": {
    "deny": ["Read(./.env)", "Read(./secrets/**)"],
    "disableBypassPermissionsMode": "disable"
  },
  "allowManagedPermissionRulesOnly": true,
  "allowedMcpServers": [{ "serverUrl": "https://mcp.example.com/*" }],
  "allowManagedMcpServersOnly": true,
  "strictKnownMarketplaces": [{ "source": "github", "repo": "example-shop/approved-plugins" }],
  "sandbox": {
    "enabled": true,
    "failIfUnavailable": true,
    "network": { "allowedDomains": ["registry.npmjs.org"], "allowManagedDomainsOnly": true }
  }
}
```

### TOML example

```toml
# requirements.toml for Codex, set by an administrator
allowed_approval_policies = ["untrusted", "on-request"]
allowed_sandbox_modes = ["read-only", "workspace-write"]
```

## Sources

- [Claude Code settings files and precedence](https://code.claude.com/docs/en/settings)
- [Claude Code example settings files](https://code.claude.com/docs/en/settings-example)

## Related rules

- [Skip approvals only in a throwaway sandbox](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/unattended-only-in-sandbox) in AI development

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/managed-agent-settings">Agent Wranglers AI development playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Open unknown repositories in a sandbox](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/untrusted-repositories)
- Next: [Log what every agent session does](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/agent-activity-log)
- [Safety and permissions](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions)