Start from an empty policy and build exactly what you need.

• Empty {} starting point
• No pre-filled deny rules
• Form or JSON editor
• Reset to any template later

Recommended baseline guardrails for most teams.

• Managed MCP servers only
• Blocks secrets, SSH keys, curl/wget
• Disables bypass-permissions mode

Maximum restriction — read-only and agent-free.

• Read-only by default
• Blocks shell and network tools
• Disables agents and hooks
• Forces Claude.ai login