Guide

How do you roll out Claude Code to 1,000 engineers safely?

Updated November 6, 2026

Short answer

Roll it out in stages: one pilot team, one policy pushed to every laptop by your MDM, watch-only before enforcement, then widen team by team. Don't let approval prompts be your main control. In Anthropic's study of 1,053 testers, people caught the dangerous command 13.6% of the time, and Anthropic reports users accept 93% of manual prompts anyway. Check each action automatically before it runs, keep records of every decision, and only expand once the false-block rate is low enough that engineers stop working around it.

Approval prompts break before you reach 1,000 engineers#

With one engineer and one agent, the permission prompt works. The engineer watches and clicks.

At 1,000 engineers it stops working. An agent session averages 145 actions, and long sessions go past 1,000. Nobody reads that many prompts closely.

Anthropic measured it. In a study with 1,053 testers, people caught the dangerous command just 13.6% of the time, and users accept 93% of manual prompts anyway. After enough prompts, the click is a reflex.

So the rollout question is who checks the actions once the engineer stops reading them.

What each control stops, and what it doesn't#

The built-in controls are useful. Each one covers part of the problem.

Control	What it stops	What it misses
Permission prompts	Actions a focused human spots	Anything approved on reflex, which is most of them at scale
Allow and deny rules	Commands that match a pattern as typed	The same action written another way, and safe commands blocked because they look dangerous
Managed settings pushed by IT	Engineers overriding org settings on their own laptop, since no user or project value overrides them	Whether an allowed action is safe in this session
Least privilege and scoped credentials	Damage from the access you didn't grant	Misuse of the access you did grant
EDR	Known malicious processes	Why the agent ran a command, and whether that fits the task

None of these looks at the pending action against what the session is supposed to be doing. That's the gap a rollout has to close. For more on the pattern-matching limit, see how to stop coding agents running destructive commands.

A staged rollout plan#

First: a pilot team, watch-only#

Pick one team that already uses agents heavily. Push the agent and your policy layer through the MDM you already run, in log-only mode.

You're answering one question: what do agents actually do here? Look at which commands run, which files get touched, which secrets get read and where network calls go.

Next: write the policy from what you saw#

Turn the watch-only data into rules. Block the flows that cost you an incident: secrets reaching a network call, recursive deletes at the root, force-pushes to the default branch, piping curl to a shell.

Leave routine work alone. Every needless block teaches engineers to look for a way around it.

Then: enforce on the pilot, measure false blocks#

Switch the pilot team to enforce. Track wrong blocks as a share of all decisions, and track how often engineers try to get around the control.

Don't expand until both numbers are low. A control people route around is worse than no control, because you still believe it's working.

Finally: expand team by team, one policy#

Widen in waves. Keep one policy across every agent your engineers run, so a team that switches tools doesn't drop out of coverage.

Export decision records to your SIEM from the first day of each wave. When an auditor or the board asks what the agents did, you want the records ready.

Checklist before you go wide#

Can you push one policy to every laptop and stop engineers from overriding it?
Do you know what agents did during the pilot, from records rather than anecdotes?
Is the check outside the agent, so the agent can't edit or skip it?
Does it fail closed: if the check can't run, does the action stop?
Do blocks tell the agent why, so it can retry safely instead of stalling?
Do agent credentials have the narrowest scope that still works?
Is the false-block rate low enough that engineers keep the control on?

The pre-approval questions are in the security review before approving Claude Code.

Where Harden fits#

Harden Agentic Integrity Foundation (AIF) runs on the developer laptop, outside the agent, at Claude Code's pre-execution hook. It parses each pending command, follows the data from source to destination, and allows, blocks, asks or rewrites the action before it runs. Decisions take about 28 ms (P99 about 70 ms), are made 100% locally, and nothing leaves the machine.

In our own use, it made wrong hard blocks 0.25% of the time over 24,809 decisions. It starts watch-only, is pushed by your MDM and applies one policy across every agent.

It's a layer, not a perimeter. It doesn't replace least privilege, scoped credentials or egress policy. Exfiltration split across several separate calls is the hard case. Details are on the AIF trust page.

Full Enterprise access is free for 60 days: unlimited developers, custom policies, centralized visibility, no commitment. After that it's $20 per user per month. Start free at harden.run.

FAQ