Enterprise controls and observability

Production adoption needs controls that do not depend on every developer copying the same local settings.json. Claude Code supports server-managed settings, endpoint-managed settings, and the Claude apps gateway for centralized deployment and policy.

Start with Organization setup and Server-managed settings.

Representative managed controls

Organizations can enforce boundaries such as:

{
  "permissions": {
    "disableBypassPermissionsMode": "disable",
    "disableAutoMode": "disable"
  },
  "allowManagedPermissionRulesOnly": true,
  "allowManagedHooksOnly": true,
  "allowManagedMcpServersOnly": true,
  "strictKnownMarketplaces": [],
  "sandbox": {
    "enabled": true,
    "failIfUnavailable": true
  }
}

Available keys and nesting evolve; copy exact structures from the current settings reference rather than treating this orientation example as a complete policy. Here, an empty strictKnownMarketplaces array locks marketplace installation down completely; use an array of approved marketplace source objects when the organization permits selected sources.

Other important identity controls include forceLoginMethod and forceLoginOrgUUID. Cloud-session capabilities and self-hosted execution environments need separate review because they change where code and data run.

OpenTelemetry

Enable Claude Code telemetry:

export CLAUDE_CODE_ENABLE_TELEMETRY=1

Select exporters with variables such as OTEL_METRICS_EXPORTER and OTEL_LOGS_EXPORTER. Enhanced traces are Beta and additionally require:

export CLAUDE_CODE_ENHANCED_TELEMETRY_BETA=1

Do not confuse this with instrumenting the application Claude is editing. Claude Code telemetry measures agent usage and events; your application still needs its own observability.

See Monitoring usage.

Analytics APIs

The daily Claude Code usage report is available through:

GET /v1/organizations/usage_report/claude_code?starting_at=YYYY-MM-DD

The Claude Code Analytics API uses an Admin API key. The broader Claude Enterprise Analytics API uses an Analytics API key. Keep those credentials in a secret manager and grant reporting jobs only the scope they need.

See Claude Code Analytics API.

Rollout checklist

• Force the intended organization and login method.
• Disable bypass modes that policy does not permit.
• Require sandbox startup to fail closed where isolation is mandatory.
• Allowlist MCP servers, hooks, and plugin marketplaces.
• Export enough telemetry to detect cost, failures, and risky patterns without collecting source content unnecessarily.
• Test policy changes in a pilot group before organization-wide rollout.