Protect Claude Code used through a subscription

Keep secrets out of prompts, stop risky actions and mask secrets in what the assistant reads, for developers who use Claude Code with your company's Claude Team or Enterprise seats. Turn on Assistant Guard, pick the rules, apply one package in the Claude admin console or on company devices, and follow every decision in AI Guardian.

Assistant Guard in WASViking^® AI Guardian protects AI coding assistants that your people use through a subscription, starting with Claude Code on Claude Team and Enterprise seats. You keep paying by seat: the assistant still talks to its vendor directly. What changes is that the assistant asks WASViking first, through its own managed settings:

• before a prompt leaves: a prompt with a secret, or with personal data if you choose, is stopped and never reaches the model;
• before an action runs: reading a key file, a destructive command or an infrastructure change can be denied or need the developer's confirmation;
• before the assistant reads a result: secrets in a file or a command output are masked before the assistant sees them.

WASViking never sees the developer's Claude sign-in and never relays the conversation with the model.

Before you start

• Assistant Guard is an add-on from the Pro plan, contracted on its own. Until it is part of your contract, its screen shows a locked page with Activate, which sends the request to your partner or WASViking sales.
• In WASViking, an administrator role, or a role with AI Gateway manage access. Applying a rule preset also needs manage access to AI Guardian policies.
• On the Claude side, a person with the Owner role of your Claude Team or Enterprise organization (to paste the package in the admin console), or your IT team (to deliver it to company devices).
• Claude Code 2.1.295 or later on the developers' computers.
• Your developers in your WASViking directory with the same e-mail they use to sign in to Claude, so each decision is tied to the person.

Step 1: turn it on and choose the behavior

Open AI Guard > Protection > Assistant Guard, tab Set up:

1. Tick Assistant Guard is on for this organization.
2. Choose what happens when WASViking cannot answer, for prompts and for actions: Block it or Let it go on (recorded). The suggested choice blocks prompts (no secret leaves while WASViking is unreachable) and lets actions go on (an outage never stops people from working).
3. Enter your Claude organization ID, from the Claude admin console. On company devices, only that organization can sign in.
4. Optionally pick an MCP gateway or Secure Agent to give every developer, so the tools the assistant uses also go through WASViking.
5. Click Save.

Step 2: choose the rules

Apply a preset, then adjust it like any other rule in AI Guardian Policies:

In AI Guardian Policies, the surfaces Coding assistants: prompts, Coding assistants: actions and Coding assistants: action results accept the usual data conditions plus Action (shell command, read a file, write a file, MCP tool, web), Command and File path with wildcards, for example terraform apply* or *.pem. Existing rules of other surfaces never apply to the assistant unless you add these surfaces to them.

Step 3: create the organization token

Click Create a token. Copy it when it appears: it is shown once and is filled in the package right away. The token only lets the assistant ask for decisions and send its telemetry; it opens no data. To change it, create a new token, apply the new package, then revoke the old one.

Step 4: apply the package

The screen shows the same package in two forms. Use one or both:

• Claude admin console: in your Claude organization, open the Claude Code managed settings (Owner role), paste the package and save. Every session signed in to your organization receives it within an hour. Each developer approves it once; rejecting it closes Claude Code.
• Company devices (MDM): your IT team saves it as managed-settings.json in /Library/Application Support/ClaudeCode/ (macOS), /etc/claude-code/ (Linux) or C:\Program Files\ClaudeCode\ (Windows). This form also pins the sign-in to your organization, so a personal Claude account cannot be used on company devices.

Developers cannot change or remove these settings. While the package is in force, their own hooks do not run.

Step 5: check

Click A prompt with a secret or Reading a .env file to see exactly what the assistant would be told with your current rules. Nothing is recorded.

What developers see

• A blocked prompt does not reach the model, and Claude Code shows your organization's message.
• A denied action does not run; Claude reads the reason and can choose another way.
• An action that needs confirmation opens Claude Code's own confirmation dialog.
• Everything else works as before: an allowed action keeps the developer's own Claude Code permission settings.

Follow what happens

• Activity: every decision with the person, the kind of action, the rule and the data found, filtered by event, decision and person. Prompts, commands, file paths and results are never stored, only what was decided and why.
• Coverage: who used the assistant under Assistant Guard in the last 30 days, and who in your directory has not been seen yet.

The package turns on Claude Code's telemetry towards WASViking only to know who is behind each session; prompt text is never asked for. The very first prompt of a session can arrive before that, so it is decided with your organization-wide rules and appears as "person not yet known".

Usage and limits

Your contract sets how many developers use the assistant under Assistant Guard: identified people with at least one decision over the last 30 days. Sessions whose person is not yet known do not count as developers; when many decisions have no identified person, the administrators receive a notice so the directory can be fixed. A panel under the header of the Assistant Guard screen shows the count against the contract, and the AI Guardian tab of Profile & Plan Usage has the same numbers in one card per module.

• Notices go out at 80% and 100% of the contract, to the alert destinations subscribed to AI Guardian Usage and by e-mail to the organization administrators.
• Above the contract nothing is billed automatically. Assistant Guard never holds or blocks a developer because of the contract: every decision keeps its normal answer, and allowed actions with no finding stop being recorded while usage stays above.
• When Assistant Guard is not part of your contract, the assistant receives an empty decision and continues, so the contract never stops a developer.

Your WASViking partner raises the capacity, or WASViking sales if you buy directly. If your organization received Assistant Guard as a 60-day trial when the modules were packaged, the panel also shows the date the trial ends.

Troubleshooting

What next

• Build a secure agent to give the assistant WASViking's governed tools.
• Govern agent tools with the MCP Gateway.