> ## Documentation Index > Fetch the complete documentation index at: https://docs.asymptotelabs.ai/llms.txt > Use this file to discover all available pages before exploring further. # Policy Enforcement > Apply your coding agent policies in Claude Code, Cursor and Codex while developers work. ## Overview Policy enforcement applies the coding agent policies you write in Asymptote while developers work. On each Mac, Beacon checks prompts and MCP tool calls against your organization's policies and, depending on the policy, steers the agent, asks the developer, or blocks. Every decision becomes a finding in Asymptote and, when Slack is connected, a message in your alerts channel. Enforcement works in Claude Code, the Cursor IDE, and Codex (the CLI, the IDE extension and the desktop app) on Apple Silicon Macs connected to your organization. ## How a policy works A policy is a rule written in plain language, such as "Agents must not post repository contents to the #general Slack channel." You set it up under **Policies**, in the coding agents section, with three settings: | Setting | Options | What happens when a prompt or tool call breaks the rule | | - | - | - | | **Prompts** | Off, **Steer**, **Block** | **Steer:** the prompt goes through, and the agent declines only the part the policy prohibits. **Block:** the prompt is rejected before it reaches the agent. | | **Tool calls** | Off, **Ask the developer**, **Block** | **Ask the developer:** the agent pauses and the developer approves or rejects the call. **Block:** the call is stopped. | | **Mode** | **Enforce**, **Monitor only** | **Enforce:** Beacon steers, asks or blocks as set above. **Monitor only:** Beacon records a finding and lets everything through. Use it to try a policy before you enforce it. | Prompts and tool calls offer different options because they happen at different moments: * **A prompt is the developer's request.** Asking the developer to approve their own request adds nothing, so a prompt is either steered (the agent does the allowed part) or blocked (the developer rephrases). * **A tool call is the agent acting.** The choice is whether the action runs, so a call is either put to the developer or stopped. A blocked call also tells the agent why, so it doesn't try another way. ### Choosing an option * Use **Block** for anything that must never happen. It applies the same way in every agent. * Use **Steer** when the rest of the request is fine and only one part breaks the rule. * Use **Ask the developer** when a person should decide case by case. It's an overridable check: the developer can approve the call, and some agents run it without asking (see below). ## What each agent does Each agent carries out these settings with its own controls, so a few results differ: | Policy setting | Claude Code | Cursor | Codex | | - | - | - | - | | Prompt: **Block** | The prompt is rejected before it reaches the agent. The developer sees the policy and why. | Same | Same | | Prompt: **Steer** | The prompt goes through, and the agent declines the part the policy prohibits and says why. | The prompt is blocked, with a note to send it again without the prohibited part. Cursor can't pass a policy note to the agent. | Same as Claude Code | | Tool call: **Block** | The call is stopped, and the agent tells the developer which policy blocked it. | Same | Same | | Tool call: **Ask the developer** | Claude Code asks for approval and shows the policy and why. | Cursor shows its approval card with the policy and why. With Run Everything on, Cursor runs the call without showing the card. | Codex can't show an approval from Beacon, so the call runs, and the finding records that nobody was asked. Codex's own MCP approval still applies. | | A secret pasted into a prompt | Blocked on the Mac before it reaches the model. The developer can send it once with `/beacon-allow `. | Masked before the prompt is checked, so the secret never reaches Asymptote. The prompt isn't blocked, so the agent's own model still receives it. | Same as Cursor | Tool call checks cover MCP tools, such as Slack, GitHub and Linear. Built-in tools like shell commands and file edits aren't checked live. Beacon masks secrets in every prompt on the Mac before checking it with Asymptote, so secrets never reach Asymptote or the model it uses to check policies. Only Claude Code also blocks the prompt, so the secret never reaches the agent's model provider either. ## Before you start * Your organization has policy enforcement turned on. Contact [support@asymptotelabs.ai](mailto:support@asymptotelabs.ai) to enable it. * The Mac is Apple Silicon, has the Beacon package installed, and is connected to your organization. See [Try on one Mac](https://docs.asymptotelabs.ai/mdm/try-on-one-mac.md) to set one up from scratch. * Nobody runs a separate user-mode Beacon on the Mac. * At least one active policy has a prompt or tool call check set. ## Turn on enforcement 1. On the Mac, run: ```bash theme={null} sudo beacon endpoint enforcement enable ``` Beacon installs its enterprise edition if the Mac doesn't have it yet, sets up enforcement for each agent the logged-in developer uses, and checks that it can reach Asymptote. 2. Confirm the output names the agents it set up and lists your policies. 3. Ask the developer to start new agent sessions. Sessions that were already open don't pick up enforcement. Codex asks developers to review new hooks before it runs them. Beacon approves its own hooks in Codex for the developer, so no review appears. If Codex isn't installed yet, run `enable` again after installing it. ## Check status ```bash theme={null} beacon endpoint enforcement status ``` Status shows whether enforcement is on, the organization and device, the agents with enforcement set up, whether Codex has approved Beacon's hooks, and the policies that apply. ## What developers see * **A blocked prompt:** the agent shows which policy blocked it and why. * **A blocked tool call:** the agent tells the developer which policy blocked the call and doesn't try another way. * **An ask:** the agent's approval prompt shows the policy and why. Approving runs the call, and Asymptote records the answer. ## Findings and Slack Each decision becomes a finding under **Findings**, tied to the developer and the device. One session's decisions for the same policy share a finding. With [Slack connected](https://docs.asymptotelabs.ai/manage/connect-slack.md), each finding posts a message to your alerts channel. Later decisions in the same session reply in its thread, and the message updates with the developer's answer to an ask: upheld, overridden, or, in Cursor, ran. ## Update or turn off Install the latest enterprise release: ```bash theme={null} sudo beacon endpoint enforcement update ``` Turn enforcement off on a Mac: ```bash theme={null} sudo beacon endpoint enforcement disable ``` This removes Beacon's enforcement from Claude Code, Cursor and Codex on that Mac. Telemetry keeps flowing as before. ## Limits * Enforcement runs through each agent's hooks. It's a guardrail for normal use, not a sandbox: someone with administrator rights on the Mac can turn it off. * If Beacon can't reach Asymptote, prompts and calls go through, and Beacon records that the check was unavailable. Secret blocks in Claude Code still apply, because they run on the Mac. * The Cursor CLI (`cursor-agent`) and cloud agents aren't covered yet. * Tool call checks cover MCP tools only. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.