The whole hunk
from line 54, old and new numbered
/
lines
from line 54
5454
5555On every operating system, the application starts a Code session only in a folder that **Allowed workspace folders** permits when that setting is configured, and Claude's file reading and editing tools then work only inside the permitted folders. Administrators can also require a prompt on every shell command, in every permission mode, with the **Require approval for each command** sub-setting on the **Shell commands** card of the [Config](/docs/government/config/settings#tool-and-connector-cards) page.
5656
57Code sessions in Claude for Government run on the local workstation only, and the environment options for Windows Subsystem for Linux (WSL) and SSH remote hosts are not available. Commands that belong to Claude Code's terminal interface, such as `/sandbox`, are not part of Code sessions in the desktop application. See [how your configuration reaches Code sessions](/docs/third-party/claude-desktop/code). If your agency also deploys Claude Code's own managed settings to the same devices, those settings take precedence over the sandbox policy described above unless they opt in to merging, as that page explains.
57Code sessions in Claude for Government run on the local workstation by default. SSH remote sessions are off unless your agency allows specific hosts in Claude Code's managed settings on the device; see [Interaction with Claude Code managed settings on the device](/docs/third-party/claude-desktop/ssh-remote-sessions#interaction-with-claude-code-managed-settings-on-the-device). On Windows, Code sessions inside a Windows Subsystem for Linux (WSL) distribution are not available.
5858
59Commands that belong to Claude Code's terminal interface, such as `/sandbox`, are not part of Code sessions in the desktop application. See [how your configuration reaches Code sessions](/docs/third-party/claude-desktop/code). If your agency also deploys Claude Code's own managed settings to the same devices, for example to allow SSH hosts, those settings take precedence over the sandbox policy described above unless they opt in to merging, as that page explains.
60
5961### Network egress, required domains, and proxies
6062
6163The desktop application and the sandbox honor the operating system's proxy settings, and a single allowlist controls outbound network access from Claude's tools. You manage the allowlist with the **Allowed network hosts** setting on the [Config](/docs/government/config/settings#allowed-network-hosts) page.
from line 144
142144 </Accordion>
143145
144146 <Accordion title="What is logged for connector actions and outbound requests?">
145 Chat, Cowork, and Code sessions write a local audit log to the user's disk recording tool invocations, permission decisions, and file operations; that log never leaves the device. The desktop can also export OpenTelemetry events to a collector you specify: tool name, connector, outcome, duration, and approval status are sent. Prompt text, Claude's responses, and tool inputs and results are included only for the categories you select in the **Telemetry content capture** setting on the [Config](/docs/government/config/settings#telemetry-content-capture) page. See [Telemetry and egress](/docs/third-party/claude-desktop/telemetry) for what the export can include. Server-side, the [Compliance API](/docs/government/org-admin/compliance-api) records identity and configuration events but never tool calls or conversation content.
147 Chat and Cowork sessions write a local audit log to the user's disk recording tool invocations, permission decisions, and file operations; that log never leaves the device. The desktop can also export OpenTelemetry events to a collector you specify: tool name, connector, outcome, duration, and approval status are sent. Prompt text, Claude's responses, and tool inputs and results are included only for the categories you select in the **Telemetry content capture** setting on the [Config](/docs/government/config/settings#telemetry-content-capture) page. See [Telemetry and egress](/docs/third-party/claude-desktop/telemetry) for what the export can include. Server-side, the [Compliance API](/docs/government/org-admin/compliance-api) records identity and configuration events but never tool calls or conversation content.
146148 </Accordion>
147149</AccordionGroup>
148150