Guide · Claude Code and Codex for teams

What should an AI coding tool policy say?

An AI coding tool policy names the tools and the accounts they run on, keeps provider keys and secrets out of laptops and prompts, says which models are allowed, caps what one person spends, says when an agent may run without asking, and ends access the day someone leaves. The template below has ten clauses. Under it, each clause is matched to the setting that makes it true.

What goes in the template?

Copy it, fill in the brackets, and delete any clause you will not enforce.

# AI coding tool policy

Owner: [name, role]
Applies to: everyone who uses AI coding tools on company code, contractors included.
Reviewed: every six months, and whenever a tool is added.

1. Tools. Claude Code, Codex and Claude Desktop are approved, on company accounts only.
   Personal subscriptions and personal API keys are not used for company code.
2. Credentials. No provider API key is kept on a laptop, in a repository or in a
   container image. People sign in with their company identity. Each CI job has its
   own named token.
3. Secrets. Secrets and customer data do not go into prompts. Secret scanning is on
   for every request.
4. Models. Only the models the owner has switched on are used: [list].
5. Spend. Each person has a spend limit of [amount] a [day, week or month].
6. Unattended agents. An agent runs without permission prompts only on a clean tree
   or in its own worktree, and in CI only with a token that reaches no production
   credentials.
7. Connected tools. Only connectors the owner has switched on are used, each signed
   in as the person using it.
8. Review. A person reviews every AI-written change before it merges.
9. Records. Each request is recorded under the person or token that made it, with the
   model and the cost. Prompt text and source code are not stored by the gateway.
10. Leaving. Access ends the day a person leaves: their sessions and tokens are revoked.

Clause 8 is enforced by your Git host's branch protection. A Claude Code review agent can add a first pass on every pull request.

A clause with no control behind it is a request, not a policy.

How do you keep everyone on company accounts?

Keep the provider keys on a gateway and sign people in to it. selan login opens Google or Microsoft sign-in. Afterwards the laptop holds one revocable Selan session token, and no Anthropic key.

selan claude drops an ANTHROPIC_API_KEY exported in the shell, so it never reaches the wire. A bare codex fails closed instead of spending the company's account. How it works is in Claude Code without API keys.

Good to know: Selan governs what goes through it. To enforce the policy at the operating-system level too, Selan composes with Anthropic's managed settings. A developer who passes their own --settings gets none of the company's settings for that launch.

How do you keep secrets out of prompts?

Turn on secret scanning, which is off by default. Every request body is then swept with gitleaks' rules, and each match is replaced before a byte goes upstream.

It redacts and forwards, and never blocks over a secret. It refuses a request when the scanner cannot be reached, so nothing goes upstream unscanned, and when a body is over 24 MiB. Developers see nothing, and owners get a Secrets feed in Logs. The detail is in Hiding secrets.

How do you limit which models developers use?

Settings → Models has one switch per model at each provider you connected. Off makes a model unreachable, even named with --model. Every provider's models start off, except a Claude or ChatGPT subscription's own current models.

Effort limits cap the reasoning effort each model maker's models run at, through every provider that serves them. The settings are listed in What an owner sets.

How do you cap what one person spends?

Set a spend limit per person, by day, week or month in UTC. It applies across every key in the company, and it binds the moment it is reached. A key can carry its own limit as well.

A person's limit stops only what is billed per token, so the company's subscription seats keep serving them. How a limit is set is on the spend page.

When may an agent run without asking?

seland runs Claude Code with --dangerously-skip-permissions, so nothing stops a bad edit as it happens. What limits the damage is what the session can reach: a clean tree, its own git worktree, and in CI a token with no production credentials.

Only an owner can mint a CI token. It expires after 1, 30, 90 or 365 days or never, and is shown once. It spends as itself, under an address like ci-nightly@tokens.selan.ai. See seland, Running unattended and how to skip permissions safely.

Which tools may an agent connect to?

Only the MCP connectors an owner switches on, and all of them start off. Each developer signs in to a connector as themselves, so their own permissions apply and Selan never holds their account. The catalog is in MCP connections.

What is recorded about each request?

Selan records the person, the model asked for and served, the tokens, the cost and the repository name. It never stores prompt text, source code or request bodies.

When a provider rejects a request, up to 2 KB of its reply is written to Selan's request log. Usage is attributed to a repository only after an owner turns that on. The full list is on Trust.

What happens when someone leaves?

Revoking a member ends their sessions immediately, along with every access token they created. A session also expires after thirty days without use. No provider key needs rotating, because none was on the laptop.

Start for free

Free for up to three seats, and the Free plan needs no card.

The short version

The policy names the tools, the accounts, the models, the spend, the unattended runs and the leavers.
Each clause needs a setting behind it: sign-in instead of keys, model switches, spend limits, secret scanning.
Selan records who made each request and what it cost, and never stores prompt text or source code.