Claude Code now starts most sessions in auto mode. Since version 2.1.283, a separate classifier model reviews what the agent does, and the person at the keyboard no longer approves each step (Claude Code docs). Most AI policies I've read were written for a world where someone clicks "approve" first. I don't think many marketing teams have noticed yet, because the change arrived as a release note.

Claude Code governance covers the rules, settings, and logs that decide what Claude Code can touch in your files, your systems, and your brand. For a CMO (chief marketing officer), I break it into three layers: a short policy for approved marketing uses, access controls that enforce it through managed settings, and monitoring that shows a person reviewed what reached customers. The rollout plan at the end gets all three running in about a quarter.

Note: Originally published May 26, 2026. Updated October 14, 2026, with auto mode, EU AI Act Article 50, the Compliance API expansion, and corrected details on enterprise controls.

Why is Claude Code governance a CMO problem?

It lands on the CMO because nobody else holds the customer data, the brand story, and the company's public voice all at once. In an August 2025 IDC webinar, 81% of marketing leaders said they're directly accountable for the digital customer experience, and 84% reported more accountability for corporate communications. Any Claude Code session that touches campaign logic, segment data, or published copy falls inside that.

A few months before I wrote the first version, I was reviewing a campaign brief my team had built with AI help, and the voice felt off. It was subtle, like a stock photo where nobody casts a shadow. When I traced it back, three people had used Claude Code in three different setups. Each had different permissions and different access to our brand docs. One was running it on a personal consumer account with no company controls at all. Nobody thought to ask me, and that's the whole problem.

Unapproved AI use, often called shadow AI, runs highest among senior people. Okta's 2026 research found that 52% of knowledge workers admit to using unapproved AI tools. TrustedTech found the rate roughly doubles at the top: 65% of decision-makers, against 31% of everyone else.

Personal accounts also carry a data cost. Anthropic updated its consumer terms on August 28, 2025. Since then, Free, Pro, and Max accounts, including Claude Code sessions run from them, can be used for model training unless the user opts out. Opting in also stretches retention from 30 days to five years (Goldfarb Gross Seligman). Team, Enterprise, and API (application programming interface) usage sit under Commercial Terms and stay out of training. So a marketer drafting launch messaging on a personal Pro account is sharing it under consumer terms, whether they realize it or not.

What controls does each Claude plan give a CMO?

Your plan sets the ceiling on what you can enforce. On a consumer plan, each person gets a privacy toggle and that's about it. Team and Enterprise give an admin policy enforcement, spend controls, and an audit trail.

‍

How you deliver the settings matters too. Server-managed settings come from Anthropic's servers when someone signs in. They work on any device, and you don't need device-management software. Endpoint-managed settings are a managed-settings.json file or OS policy that IT pushes through an MDM (mobile device management) tool like Jamf, Kandji, or Intune, and the operating system stops users from editing it. A few details from Anthropic's documentation should shape your choice:

• Server-managed settings apply to everyone in the org the same way. If you want different rules per role, you need endpoint profiles or project settings.
• If a user sets a third-party provider variable or a custom ANTHROPIC_BASE_URL in their shell, Claude Code skips the server-managed fetch.
• A managed-mcp.json file, which locks down MCP (Model Context Protocol) servers, only works when it's deployed to the device.
• Claude Code uses whichever managed source delivers a policy first, and it checks server-managed first. In most cases the two channels replace each other instead of stacking.
• Anthropic describes server-managed settings as a client-side control. On a device your company doesn't manage, a user needs no admin rights to get around them.

What I'd do: endpoint-managed settings on company laptops as the hard wall, with server-managed settings layered on for cloud sessions and anyone outside MDM.

What is the three-layer Claude Code governance framework?

The framework treats Claude Code like any other system that speaks for your brand at scale. You need rules, controls that enforce those rules, and monitoring for whatever slips through. Picture an office building. The employee handbook is your policy, the keycard readers are access control, and the security cameras are monitoring. Most companies have written the handbook. Far fewer have wired up the readers and the cameras.

Layer 1: Policy

Your acceptable use policy spells out what Claude Code can do for marketing: drafting content, running analytics queries, building internal tools. It also lists what needs a person first, like writing to the CRM (customer relationship management system), publishing anything customer-facing, or touching PII (personally identifiable information). Keep it to two pages. People don't follow policies they never finish reading.

For 2026, I'd add three things:

• Brand voice as a file. A CLAUDE.md file carries your tone rules and messaging guardrails into every session. Admins can now push one to the whole org through the managed claudeMd setting, and it won't trigger a security prompt (server-managed settings).
• A disclosure rule. Article 50 of the EU AI Act has applied since August 2, 2026, and the Digital Omnibus that pushed other deadlines to 2027 left it in place (The DPO Centre). If you publish AI-generated text to inform the public, you label it, unless a human takes editorial responsibility. Decide which assets get a label and which ship under a named human editor.
• A rule for outside code. On February 25, 2026, Check Point Research showed that a booby-trapped repository could run commands or leak API keys the moment someone opened it in Claude Code. Anthropic patched both flaws before the disclosure (TechRadar). I still treat agency templates, open-source landing page kits, and freelancer handoffs as untrusted: someone reviews them or opens them in a sandbox before anyone runs Claude Code inside them.

Layer 2: Access control

This is where the policy gets teeth. Give each role a permission profile that matches how much damage it could do.

‍

Here's a baseline managed config for a marketing team. It blocks credential files, turns off bypass permissions mode, starts everyone in manual approval, limits permission and MCP rules to the managed list, and won't start without a fresh copy of the policy:

{
  "permissions": {
    "deny": ["Read(./.env)", "Read(./.env.*)", "Read(./secrets/**)"],
    "disableBypassPermissionsMode": "disable",
    "defaultMode": "default"
  },
  "allowManagedPermissionRulesOnly": true,
  "allowManagedMcpServersOnly": true,
  "forceRemoteSettingsRefresh": true
}

That config starts people in manual mode, and they can still switch into auto mode. If you want auto mode gone for marketing entirely, add "disableAutoMode": "disable" under permissions (permission modes).

Pair allowManagedMcpServersOnly with an allowedMcpServers list of the integrations you've approved (managed MCP docs). Every connection you add, whether Slack, HubSpot, Salesforce, or an internal API, gives the agent one more place to act. So anything touching production data starts read-only, and write access goes through a documented approval. Set spend caps here too. An agentic loop that runs away on a content pipeline overnight can burn through a surprising amount of budget.

Layer 3: Monitoring

Policy says what the agent should do. Monitoring shows what it did. Anthropic's Compliance API now connects to more than 100 security and compliance partners, up from 28 in May, so Claude activity can flow into the DLP (data loss prevention) and SIEM (security information and event management) tools your security team already runs. It exposes activity events like logins, admin actions, and configuration changes, and Enterprise admins can pull conversation content as well (Let's Data Science). Changes to managed settings create their own audit events, with who made the change and the before-and-after values (server-managed settings).

Turning on the logs takes an afternoon. Getting someone to read them is the hard part, and auditors will ask for proof that a person reviewed them on a schedule. Name an owner and set a weekly review before you pipe the feed into Datadog, Splunk, or Grafana.

Monitoring is also how a workflow earns more autonomy. Marketing agents start at the bottom tier and move up once they've shown they get it right.

Why does a human approval gate matter so much at scale?

Small error rates add up when you ship a lot, and AI lets you ship a lot. If each asset has a small chance of putting a mistake in front of a customer, the odds of at least one incident climb with every asset:

‍

p is the chance that one asset carries a customer-visible error. n is how many assets you ship. It works like a 0.5% chance of rain every day. You'd skip the umbrella on any single morning, and you'd still get soaked at some point during the year.

Say your team ships 400 AI-assisted assets a quarter across email, social, landing page variants, and ad copy. Use an illustrative error rate of 0.5% per asset, with no review step:

Now add a reviewer who catches nine out of ten of those errors. That drops p to 0.05%:

An incident goes from close to certain to about one-in-five odds. Every asset that passes review also fits the Article 50 path for editorial responsibility. That's why my rule hasn't changed since May: no AI-generated content reaches a customer without a person in the approval chain. Auto mode makes the rule matter more. Its classifier blocks things like data exfiltration, production deploys, and force pushes, and it has no opinion on whether a headline sounds like you.

What is a Brand CISO?

A Brand CISO is a CMO who governs the AI systems that create and distribute brand content, along with the content itself. The name borrows from the CISO (chief information security officer), because the job increasingly looks like security work. Brand control used to come from owning the tools and the production budget. That's hard to hold onto when anyone can open an agent that drafts faster than your review queue clears. I've started treating brand like infrastructure: people can attack it, it makes promises on your behalf, and it carries regulatory risk.

No single team can carry this, so give each function a clear piece of it.

Before you formalize anything, find out what people are already doing. Anonymous surveys, network monitoring for traffic to AI endpoints, and a pass through expense reports will tell you most of it. Read the results as a list of needs your approved tools aren't meeting yet, then steer people toward the approved options so their usage stays out in the open. If you want to see how fast one AI incident turns into a brand story, I wrote about it in AI security breaches and marketing.

How should marketing teams roll out Claude Code governance?

I'd roll it out in three phases over about a quarter: lock down accounts and settings in the first month, write the rules and widen access over the next two months, then scale it org-wide and put it on a review schedule.

Phase 1: Lock down the basics (weeks 1 to 4). Find out who uses Claude Code and on which plan, and move anyone on a consumer account into the company workspace. On Enterprise, turn on domain capture so new sign-ups with a company email land in your managed org. Set an org-wide spend cap, push the baseline config above through MDM, and decide on day one whether marketing keeps auto mode. Use requiredMinimumVersion to set a version floor, so nobody runs a build from before the February 2026 security fixes. Then pick five to ten marketing engineers and power users as a pilot group. People who help write a policy tend to defend it later.

Phase 2: Write the rules and widen access (weeks 5 to 12). Publish the two-page policy, Article 50 disclosure rule included. Build your approved MCP list and enforce allowManagedMcpServersOnly. Push a company-wide brand CLAUDE.md through the claudeMd key, and add repo-level CLAUDE.md files for team-specific details. Connect the Compliance API to your security tools and assign someone to review the logs. Open access to 20 to 50 people across marketing ops, content, and SEO (search engine optimization). Give every active use case an autonomy tier, and put the approval step into your CMS (content management system) staging workflow.

Phase 3: Scale it and keep it running (month 3 onward). Roll managed settings out to the whole org. If you route traffic through a central AI gateway with ANTHROPIC_BASE_URL for logging and PII detection, deliver policy through endpoint-managed settings, since that variable makes Claude Code skip the server-managed fetch. Turn the steering group into a standing meeting. Every quarter, review autonomy tiers and audit a sample of AI-assisted content for brand voice. Revisit the policy once a year.

If you're building marketing tools with Claude Code while all this gets set up, my walkthrough on building a CMO dashboard with Claude Code and first-party data makes a good first governed project. And Claude Code vs. the browser tab covers why the agent is becoming one of the main users of your stack.

The CMO who builds the governance layer before something goes wrong owns the narrative. The one who waits inherits someone else's incident report.

If this connects to something you're trying to solve, book a complimentary consulting session. No pitch, just perspective.

Frequently asked questions about Claude Code governance

What is Claude Code governance?

Claude Code governance is the set of policies, technical controls, and monitoring an organization uses to manage how Claude Code, Anthropic's agentic coding tool, operates across its teams. Because Claude Code can read files, run commands, connect to external services through MCP, and act with little human input in auto mode, it needs governance that covers permissions and audit trails along with content rules.

Why is Claude Code governance a CMO responsibility?

The CMO owns the three things most exposed by ungoverned Claude Code use: customer data relationships, brand narrative, and the company's external voice. An August 2025 IDC webinar found 81% of marketing leaders are directly accountable for the digital customer experience and 84% face increased accountability for corporate communications.

What is auto mode in Claude Code?

Auto mode is a Claude Code permission mode where a separate classifier model reviews the agent's actions in place of routine human approval prompts. It blocks actions such as data exfiltration, production deploys, and force pushes by default. Since version 2.1.283, it is the starting mode for interactive terminal and VS Code sessions, and Team and Enterprise admins can disable it with the permissions.disableAutoMode managed setting.

Does Anthropic train on Claude Code sessions?

It depends on the plan. Since Anthropic's consumer terms update on August 28, 2025, Free, Pro, and Max accounts, including Claude Code sessions run from them, can be used for model training by default unless the user opts out. Team, Enterprise, and API usage fall under Commercial Terms and are excluded from training.

What is the difference between server-managed and endpoint-managed settings?

Server-managed settings are delivered from Anthropic's servers through the claude.ai admin console on Team and Enterprise plans and work on any device. Endpoint-managed settings are deployed to devices through MDM tools like Jamf, Kandji, or Intune and are protected from user edits by the operating system. Anthropic describes server-managed settings as a client-side control, so endpoint-managed settings give stronger guarantees on corporate devices.

How does the EU AI Act affect AI-generated marketing content?

Article 50 of the EU AI Act has applied since August 2, 2026, and the Digital Omnibus did not delay it. Deployers that publish AI-generated text to inform the public must disclose it unless a human takes editorial responsibility, so a documented human review gate doubles as a compliance control for marketing teams.

What level of autonomy should marketing AI agents have?

Marketing AI agents should start at the lowest autonomy tiers, where they suggest or draft and a human approves every output before publication. Higher tiers, such as executing in staging or acting in production with audit logs, should be granted only to narrow workflows with a demonstrated accuracy record. Customer-facing content should always pass through a human approval gate.

What is the Claude Compliance API?

The Compliance API is an Anthropic enterprise feature that gives programmatic access to Claude activity events, such as logins, admin actions, and configuration changes, and to conversation content for Enterprise administrators. As of September 2026 it connects to more than 100 security and compliance partner integrations for routing into existing DLP and SIEM tools.

What is a Brand CISO?

A Brand CISO is a CMO who governs the AI systems that generate and distribute brand content, along with the content itself. The role owns the policies, technical controls, and monitoring that decide what those systems can do in the company's name, working with the CISO, Legal, Engineering, and Marketing Ops.