Use case · Protect
Nobody knows what our agents may do. Now one policy says.
On Team, one Protect policy covers the org, and an agent cannot loosen it. One screen shows every rule; History shows who changed each one and why. It blocks Claude Code and Codex calls through the gateway, on every machine; other agents are recorded, not blocked.
Each engineer set their own agent rules. Nobody can say what is allowed.
Built-in permissions
- Managed settings in Claude Code
- requirements.toml in Codex
- One file per tool
One Protect policy
- One policy for Claude Code and Codex
- One log, one history
- Agents cannot loosen it
Nothing on each laptop but a base URL.
You do not start from a blank page.
A switch shows a dry run first: rules added, changed and removed, and why a change loosens the policy.
Balanced starts 4 rules in Monitor. Set any other rule there first.
The call runs, and the log records "would block".
Overview shows the blocked and would-block counts for 7 days. Activity lists what no rule covers yet.
A teammate's agent tries to read .env on their laptop.
.env and .env.*. Examples and templates are allowed.
⛔ context-mode Protect blocked this command, so it was NOT executed: Blocked by your team’s policy: Read environment files. .env files hold secrets. … Tell the user it was blocked and continue with other work.
On Team, every member's Claude Code and Codex calls follow the org rules. Other agents are recorded, not blocked.
Someone wants a rule gone.
An API key can
- Make the policy stricter
Needs a person signed in, and a reason
- Delete a block
- Switch a rule off
- Turn Protect off
- Widen the site list
API key: turn Protect off → 403 History: 40 entries, record check passed
From the latest production run. History marks every loosening change.
Every laptop has its own rules. Nobody can read them all.
Claude Code has permissions and managed settings. Codex has approvals and requirements.toml. Each tool keeps its own.
A security lead cannot say what any agent on the team may run, read or fetch.
A new block rule can stop real work on day one, for the whole team.
Watch first. Then block, for everyone.
- 01Start from a preset
Pick Balanced for the org in the console. Each laptop needs only the base URL that
npx @context-mode/cliwrites. - 02Pick a preset, watch new rules
In Balanced, 4 of its 25 rules start in Monitor; the rest block at once. Set any other rule to Monitor before you switch to it. A rule in Monitor lets the call run and logs "would block". The switch shows a dry run first.
- 03Block, and lock it
Switch the rules you trust from Monitor to block. Agents cannot loosen them, and a script with an API key gets a 403 if it tries.
cat .env on any laptop.- Read environment files: blocked
- Push to protected branches: blocked
- Change cloud resources: Monitor
A key tried to turn Protect off. It got a 403.
| Protect | Built-in permissions | |
|---|---|---|
| Covers | Every agent and machine on the account | One client, one machine |
| Policy | One policy for Claude Code and Codex, one log, one history | Managed settings in Claude Code, requirements.toml in Codex: one file per tool |
| Decides by | What a call does, even inside sudo or sh -c | Rules per client |
| Set up | One command | Per client |
The org-wide case is not part of the test run. Of the 126 checks, 103 are matrix cases; the rest cover the on/off switch, presets, custom rules, history and speed. Only Claude Code and Codex calls are blocked: how enforcement works. How we tested Protect → The compare table: method and sources.
Every change has a name. Every block has a row.
An API key can only make the policy stricter. Deleting a block, switching a rule off or widening the site list needs a person signed in to the console, plus a reason. History marks it.
What agents tried and which rule answered. Export as CSV or JSON Lines. No command text or file contents.
Export one policy.json. Exporting twice gives the same bytes, so a git diff shows only real changes.
What this uses.
Checks every tool call before your terminal runs it. In every plan, off until you turn it on.
Observe, Balanced and Locked down, the packs, and how a rule runs in Monitor or enforce.
One Protect policy for the org that agents cannot loosen. One bill, at least 2 seats.
Every rule type, the Protect screen, History, import and export.
Related: For security teams · Keep .env secrets out · Protect main · Plans
Write the rules once. Every member's Claude Code and Codex calls follow them.
The org policy is part of Team. Write to sales@context-mode.com. To try Protect alone first, npx @context-mode/cli connects your agents: 1,000 requests free, no card.