Security and data handling changedgovernment/security/security-and-data-handling
Nearest release: v2.1.299, published 8 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 13 Oct 2026 15:23 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 13 Oct 2026 15:37 UTC.
Upstream edited
Recorded here
Lines+6added
Lines−3removed
From line
48
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits26to this page, all time
The whole hunk
from line 48, old and new numbered
/
from line 48
4848
4949In container-based Linux environments, such as cloud development workspaces, the sandbox can fail to start, and shell commands in Code sessions then fail with a `bwrap` error. To run Code sessions there, turn off the **Shell command sandbox** switch under **Advanced settings** in the **Claude Code** section of the [Config](/docs/government/config/settings) page, at the level that applies to the members who work in those environments, such as a [directory group](/docs/government/config/overview#group-specific-settings).
5050
51The **Shell command sandbox** switch applies to those members on every device they use, not only in the container workspaces. Shell commands in their Code sessions then run without the sandbox, under the permission mode the user selects for the session, as they do on Windows, and the **Allowed network hosts** and **Allowed workspace folders** settings no longer confine what those commands can reach or change. The switch reaches Code sessions in Claude Desktop 2.9939.2 or later. The switch also turns the sandbox off in those members' sessions in the Claude Code command-line tool.
51The **Shell command sandbox** switch applies to those members on every device they use, not only in the container workspaces. It reaches their Code sessions where your organization's [Claude Code settings](/docs/government/config/settings#claude-code) do. Shell commands in those Code sessions then run without the sandbox, under the permission mode the user selects for the session, as they do on Windows, and the **Allowed network hosts** and **Allowed workspace folders** settings no longer confine what those commands can reach or change. The switch also turns the sandbox off in those members' sessions in the Claude Code command-line tool.
5252
5353On Windows, there is no operating-system-level sandbox for Code sessions. Shell commands run directly on the device under the permission mode the user selects for the session and under your agency's own endpoint and network controls. The **Allowed network hosts** and **Allowed workspace folders** settings do not confine what those commands can reach, read, or change.
5454
from line 56
5656
5757Code sessions in Claude for Government run on the local workstation by default. SSH remote sessions are off unless your agency allows specific hosts in Claude Code's managed settings on the device; see [Interaction with Claude Code managed settings on the device](/docs/third-party/claude-desktop/ssh-remote-sessions#interaction-with-claude-code-managed-settings-on-the-device). On Windows, Code sessions inside a Windows Subsystem for Linux (WSL) distribution are not available.
5858
59Commands that belong to Claude Code's terminal interface, such as `/sandbox`, are not part of Code sessions in the desktop application. See [how your configuration reaches Code sessions](/docs/third-party/claude-desktop/code). If your agency also deploys Claude Code's own managed settings to the same devices, for example to allow SSH hosts, those settings take precedence over the sandbox policy described above unless they opt in to merging, as that page explains.
59Commands that belong to Claude Code's terminal interface, such as `/sandbox`, are not part of Code sessions in the desktop application. See [how your configuration reaches Code sessions](/docs/third-party/claude-desktop/code). If your agency also deploys Claude Code's own managed settings to the same devices:
6060
61* **Where your organization's [Claude Code settings](/docs/government/config/settings#claude-code) reach Code sessions**: Claude Code uses them instead of the Claude Code policy in those managed settings, such as hooks and permission rules, apart from the [keys Claude Code reads from every admin source](https://code.claude.com/docs/en/managed-settings#keys-read-from-every-admin-source). The restrictions Claude Desktop [applies as managed policy](/docs/third-party/claude-desktop/code#applied-as-managed-policy) also apply. Where they conflict with your organization's settings, such as on whether the sandbox is on, your organization's value wins, though some of Claude Desktop's restrictions stay on whatever your organization sets. Claude Desktop itself still reads some keys from those managed settings, such as the [SSH host allowlist](/docs/third-party/claude-desktop/ssh-remote-sessions#interaction-with-claude-code-managed-settings-on-the-device).
62* **Where they don't**: whether the restrictions Claude Desktop [applies as managed policy](/docs/third-party/claude-desktop/code#applied-as-managed-policy), the sandbox included, still apply beside those managed settings depends on their `parentSettingsBehavior`. With `"merge"`, those restrictions also apply. Where they conflict with those managed settings, such as on whether the sandbox is on, the managed settings' value wins, though some of Claude Desktop's restrictions stay on whatever those managed settings set. [Interaction with Claude Code's own managed settings](/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) explains each value.
63
6164### Network egress, required domains, and proxies
6265
6366The desktop application follows the operating system's proxy settings, and a single allowlist controls outbound network access from Claude's tools. You manage the allowlist with the **Allowed network hosts** setting on the [Config](/docs/government/config/settings#allowed-network-hosts) page.
from line 113
110113 </Accordion>
111114
112115 <Accordion title="Can individual shell commands be allowlisted enterprise-wide?">
113 Not in Chat or Cowork. Administrators can turn the built-in **Web search**, **Web fetch**, and **Shell commands** tools on or off, or require approval on every use, but cannot allowlist individual commands within those tools. In Chat, an approval for a shell command covers that one command, with no standing approval. For analyses that take many steps, Cowork runs shell commands in the sandbox without prompting; you make Cowork available to members under **Product availability** on the [Config](/docs/government/config/settings#product-availability) page. Code sessions follow Claude Code's own permission rules, which your agency can set in a Claude Code managed-settings file. See [Code in Claude Desktop](#code-in-claude-desktop).
116 Not in Chat or Cowork. Administrators can turn the built-in **Web search**, **Web fetch**, and **Shell commands** tools on or off, or require approval on every use, but cannot allowlist individual commands within those tools. In Chat, an approval for a shell command covers that one command, with no standing approval. For analyses that take many steps, Cowork runs shell commands in the sandbox without prompting; you make Cowork available to members under **Product availability** on the [Config](/docs/government/config/settings#product-availability) page. In Code sessions, the [Claude Code](/docs/government/config/settings#claude-code) section has no setting that allows individual commands. Permission rules in a Claude Code managed-settings file on the device can allow individual commands, but they apply in Code sessions only where your organization's Claude Code settings don't reach them, as [Code in Claude Desktop](#code-in-claude-desktop) describes.
114117 </Accordion>
115118
116119 <Accordion title="Can users suppress approval prompts with an Always allow choice?">
No line in this hunk matches that.