What you will be able to do
- Recognise how an organization's AI policy is turned into enforced controls rather than left as guidance
- Explain why a connector or data source needs organizational approval before you link it to Claude
- Choose the right action when a feature is blocked or when the policy says nothing about a capability
Key concept
Policy as enforced guardrails — An organizational AI policy is more than a document. Administrators turn it into settings that members cannot override, so your job is to work inside those controls and to ask whoever owns them when you need something they don't allow, not to route around them.
1.From written policy to enforced settings
Many people picture an AI policy as a PDF on the intranet: a list of dos and don'ts that each employee reads once and then interprets for themselves. Anthropic's tooling assumes something stronger. Organizations can write their policy down and also enforce it. Anthropic describes managed policy settings as a way to deploy and enforce settings across all Claude Code users to match internal policies, "including tool permissions, file access restrictions, and MCP server configurations."
Anthropic's security guidance for Claude Code lists this enforcement as a baseline practice next to two human ones: sharing approved configurations and training people. The full set is to use managed settings to enforce organizational standards, share approved permission configurations through version control, and train team members on security best practices. Taken together, a policy that only says "use common sense" covers just one of these three. Nothing is written down to share, and nothing is enforced.
An enforced policy can be short. The example below comes from Anthropic's managed-settings documentation. It blocks Claude from reading a project's secrets file and secrets folder. It also turns off the mode that bypasses permission prompts, and it makes the managed file the only allowed source of permission rules, so a user's own settings can't loosen the rules. Administrators deliver the file to each machine through a system directory, an MDM profile or the claude.ai admin console. The organization's standard then applies the same way on every device.
Checkpoint 1 of 5· Fill the gap
This managed-settings file stops Claude from reading the .env file and the secrets folder. Which permission key belongs in the blank?
{
"permissions": {
" ? ": [
"Read(./.env)",
"Read(./secrets/**)"
],
"disableBypassPermissionsMode": "disable"
},
"allowManagedPermissionRulesOnly": true
}Permission rules can allow, ask or deny. Keeping a tool away from secrets needs a deny rule, and allowManagedPermissionRulesOnly stops users from adding their own rules to override it.
Source: code.claude.comMost of these controls are invisible from your side until you hit one. One user-facing control does stay in view: an organization can place a managed policy CLAUDE.md file containing "Org-wide instructions loaded in every session, can’t be excluded." If your organization uses one, its instructions are part of every session whether you remember them or not.
2.Approval before you connect a data source
Connectors are where AI policy matters most to an individual employee, because connecting a service is not a read-only act. In Anthropic's words, when you connect a service "you're granting Claude permission to access and potentially modify data within that service based on your account permissions." Their advice to individuals is: "Only connect services you trust and need for your workflows."
On Team and Enterprise plans, approval is built into the product. Before members can use connectors, an Owner or Primary Owner needs to enable them for the organization. Owners can also limit what a connector may do. For example, they can let Claude read files in Google Drive but not create or edit them. Each permission category is set to Always allow, Needs approval or Blocked, and this applies org-wide to everyone using the connector—individual users can't override it. Claude also inherits each person's own permissions in the source system. A connector never reaches a file the person couldn't open themselves.
Checkpoint 2 of 5· Put it in order
Put the steps that bring a directory connector into use on a Team or Enterprise plan in order.
- 1.Each member authenticates with the connector before using it
- 2.They click Browse connectors
- 3.They select the connector and click Add to your team
- 4.An Owner or Primary Owner opens Organization settings > Connectors
Org-level enablement comes first and only makes the connector available. Access starts when each individual authenticates.
“Individual users can then authenticate with the connector to start using it with Claude.”Source: support.claude.com
Claude Code applies the same idea to MCP servers, which are how it connects to outside tools. Administrators choose how tightly to control which servers people can add. The options run from switching MCP off entirely, through publishing an approved catalog, to imposing no restrictions. A denylist always wins: "Nothing overrides a denylist match." If your organization has deployed a fixed server set and you try to add your own, Claude Code stops at startup with the message "You cannot dynamically configure MCP servers when an enterprise MCP config is present." That message is the policy at work, not a bug.
| Pattern | What it does |
|---|---|
| Disable MCP | No servers load except the few that load under exclusive control |
| Fixed deployment | Every user gets the same servers and can’t add others |
| Approved catalog | Publish a list of approved servers; users add the ones they want, anything else is blocked |
| Denylist only | Block known-bad servers, allow everything else |
| No restrictions | Users add anything |
Checkpoint 3 of 5· Match them up
Match each MCP control pattern to what a user experiences under it.
Tap a term, then the definition that fits it.
Each pattern sets a different balance between user choice and central control. The approved catalog is the usual middle ground: users can choose, but only from a list the organization has approved.
“Publish a list of approved servers; users add the ones they want, anything else is blocked”Source: code.claude.com
3.When a restriction stops you, or the policy says nothing
Sooner or later a control will block you. On Enterprise plans the product tells you why and where to go. A feature switched off for the whole organization shows the message "This feature is disabled for your organization." A feature your role doesn't include says "Contact your admin to request access to this feature." A blocked connector tool says "This tool is not enabled for your role. Contact your administrator." Members can’t tell which layer restricted a tool, so your job is not to work out the cause. Your job is to ask the person who owns the setting. Role grants narrow access within the policy; they can’t widen past it. If connector permissions briefly fail to load, "Access fails toward denying, never toward granting."
The harder case is a capability your policy doesn't mention. Silence is not permission. The sources do not set out a formal escalation path, but they consistently point back to the organization. If something goes wrong, the advice is to delete the conversation, request deletion through the platform's privacy process, "and follow your organization's protocols." Tools also differ in how they protect data: "Different tools have different rules." A privacy setting on a personal plan is not the same thing as your organization's approval to put its data there.
Organizational policy also sits on top of the vendor's rules, never in place of them. "All uses of agents and agentic features must continue to adhere to Anthropic’s Usage Policy." For example, that policy prohibits using agents to monitor people's online activity without their knowledge or consent, whatever an internal policy allows.
Checkpoint 4 of 5· Exam question
A company systematically queries Claude through the API to collect large volumes of model outputs, then uses that data to train a rival large language model that it plans to sell. This activity is:
Correct answer: C — Prohibited under the Usage Policy's restrictions on using Claude's outputs to develop competing models.
- A. Incorrect. Ownership of individual outputs does not exempt systematic scraping used to train a competing model from Usage Policy restrictions.
- B. Incorrect. Omitting attribution does not make the underlying prohibited activity, training a competitor on scraped outputs, acceptable.
- C. Correct. The Usage Policy prohibits model scraping and using Claude's outputs to develop competing models.
- D. Incorrect. The prohibition applies to the scraping and competing-model training itself, not only to republishing Anthropic's original training data.
Checkpoint 5 of 5· Check yourself
A Claude Enterprise member sees a connector tool greyed out with the message "This tool is not enabled for your role. Contact your administrator." What should they do?
The message points to a deliberate restriction in the organization's tool policy or the member's role. The sanctioned route is to ask the admin who owns that setting, not to get around it with another account or another person.
“This tool is not enabled for your role. Contact your administrator.”Source: support.claude.com
Exam traps
Each one states something that sounds right. Open it to see what is actually true.
1.Once an Owner enables a connector for the organization, every member automatically has access to the connected data.Why is that wrong?
Enabling a connector only makes it available. Each person still authenticates individually, and Claude can reach only what that person can already reach in the source system.
Covered in Approval before you connect a data source
2.A greyed-out feature is a technical glitch to work around, for example by switching to another account.Why is that wrong?
Greyed-out features and tools reflect organization or role restrictions, and the product points the member to their admin. Requesting access is the sanctioned path.
Covered in When a restriction stops you, or the policy says nothing
Sources
Every claim above is drawn from one of these pages, quoted as it was written on the date shown.
- 1.https://code.claude.com/docs/en/securityOfficial docs
“Use managed settings to enforce organizational standards”
↩︎ From written policy to enforced settings“Share approved permission configurations through version control”
↩︎ From written policy to enforced settings“Train team members on security best practices”
↩︎ From written policy to enforced settings“Use managed settings to enforce organizational standards”
↩︎ Key concept - 2.
“including tool permissions, file access restrictions, and MCP server configurations”
↩︎ From written policy to enforced settings - 3.https://code.claude.com/docs/en/admin-setupOfficial docs
“Org-wide instructions loaded in every session, can’t be excluded”
↩︎ From written policy to enforced settings - 4.https://support.claude.com/en/articles/11176164-use-connectors-to-extend-claude-s-capabilitiesOfficial docs
“Before members of Team and Enterprise plans can use connectors, an Owner or Primary Owner needs to enable them for the organization.”
↩︎ Approval before you connect a data source“you're granting Claude permission to access and potentially modify data within that service based on your account permissions”
↩︎ Approval before you connect a data source“This applies org-wide to everyone using the connector—individual users can't override it.”
↩︎ Approval before you connect a data source“Enabling a connector makes it available to your team, but it doesn't automatically grant anyone access.”
↩︎ Exam trap 1“Enabling a connector makes it available to your team, but it doesn't automatically grant anyone access.”
↩︎ Prediction“Individual users can then authenticate with the connector to start using it with Claude.”
↩︎ Checkpoint - 5.https://code.claude.com/docs/en/managed-mcpOfficial docs
“Nothing overrides a denylist match.”
↩︎ Approval before you connect a data source“You cannot dynamically configure MCP servers when an enterprise MCP config is present.”
↩︎ Approval before you connect a data source“Publish a list of approved servers; users add the ones they want, anything else is blocked”
↩︎ Checkpoint - 6.https://support.claude.com/en/articles/13930452-manage-custom-roles-on-enterprise-plansOfficial docs
“Members can’t tell which layer restricted a tool.”
↩︎ When a restriction stops you, or the policy says nothing“Access fails toward denying, never toward granting.”
↩︎ When a restriction stops you, or the policy says nothing“Contact your admin to request access to this feature.”
↩︎ Exam trap 2“This tool is not enabled for your role. Contact your administrator.”
↩︎ Checkpoint - 7.https://academy.claude.com/courses/ai-fluency-for-nonprofits/understanding-privacy-and-dataOfficial docs
“Delete the conversation, request data deletion through the platform's privacy process, and follow your organization's protocols”
↩︎ When a restriction stops you, or the policy says nothing - 8.https://support.claude.com/en/articles/12005017-using-agents-according-to-our-usage-policyOfficial docs
“All uses of agents and agentic features must continue to adhere to Anthropic’s Usage Policy.”
↩︎ When a restriction stops you, or the policy says nothing