Skip to content
Arcjet Docs

Block personal coding agent accounts

Arcjet hooks and Claude Compliance see sessions that authenticate to your approved tenant. They don’t see a personal Claude, ChatGPT, Copilot, or Cursor account on the same laptop. Those products share domains with the enterprise tier, so a hostname allowlist doesn’t separate them.

Each vendor offers an account or network restriction that refuses the personal path. Your secure web gateway (SWG) or MDM injects that control. Arcjet does not inject the headers, does not deploy the MDM policy, and does not receive personal sessions.

Use this layer with coding agent hooks and Compliance or OpenTelemetry ingest so the approved path is visible and governed.

Why personal accounts are invisible

Section titled “Why personal accounts are invisible”

A developer can open the same app with a personal login on a corporate laptop. That traffic looks like any other request to the vendor. Your organization’s Compliance feed and Arcjet hooks never see it.

Hooks and Compliance then govern only the approved tenant, while personal use on the same network leaves no transcript and no decision.

What to restrict

Section titled “What to restrict”

Pick the control that matches the agent. Overwrite a header when the vendor uses one. Don’t append a second copy.

AgentControlMatchIdentifier
Claude CodeHeader overwriteclaude.ai, api.anthropic.com, claude.com, anthropic.comanthropic-allowed-org-ids
CodexHeader overwrite, plus local Codex requirementschatgpt.comChatGPT-Allowed-Workspace-Id
CopilotPlan-based DNS allow and block*.business.githubcopilot.com, *.enterprise.githubcopilot.com, *.individual.githubcopilot.comCopilot plan endpoints
Copilot (EMU)Header overwritegithub.com, api.github.com, *.githubcopilot.comsec-GitHub-allowed-enterprise
CursorMDM policy on the deviceCursor editorAllowedTeamId

Anthropic Tenant Restrictions refuse any organization that isn’t on your allowlist, including personal accounts. The restriction covers web sessions, the desktop app, API keys, and OAuth tokens.

A TLS-inspecting proxy overwrites this header:

anthropic-allowed-org-ids: ORG_UUID

Replace ORG_UUID with your Claude organization UUID. For more than one organization, join UUIDs with commas and no spaces.

You need a Claude Enterprise plan or a Claude Console organization, TLS decryption on for those domains, and traffic going through the SWG.

Find the UUID in Claude Enterprise under Settings > Account (Organization ID), or in the Claude Console under Settings > Organization.

If the proxy appends a second anthropic-allowed-org-ids value, Anthropic returns 400. For the ;n=K continuation format, see Anthropic’s Tenant Restrictions.

Inject the header

Section titled “Inject the header”

Cloudflare documents a Claude example in Modify HTTP request headers in Gateway.

  1. In Cloudflare One, go to Traffic policies > Firewall policies > HTTP.

  2. Select Add a policy.

  3. Match Application Claude, or the domains claude.ai, api.anthropic.com, claude.com, and anthropic.com.

  4. In Action, select Allow.

  5. Under Modify request headers, select Overwrite. Don’t use Add.

  6. Set anthropic-allowed-org-ids to your organization UUID and save. TLS decryption must be on.

Cato uses a Tenant Restriction policy. FortiGate and FortiSASE use a web proxy profile on a proxy-mode policy with deep inspection. Any HTTPS proxy that can overwrite headers works. For vendor steps, see Cato and Fortinet.

Verify

Section titled “Verify”

From a device on the restricted network, send Anthropic’s Messages API test with an organization API key, then with a personal key:

Terminal window
curl https://api.anthropic.com/v1/messages \
  -H "x-api-key: $API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "content-type: application/json" \
  -d '{
    "model": "claude-sonnet-4-6",
    "max_tokens": 1024,
    "messages": [{"role": "user", "content": "Hello"}]
  }'

Replace API_KEY first with an allowlisted organization key (the request succeeds), then with a personal key. Expect 403 and tenant_restriction_violation. A personal sign-in to claude.ai is refused the same way.

Then install Claude Code hooks on the approved client.

Limits

Section titled “Limits”
  • These controls apply on the managed network, endpoint agent, or MDM enrollment. A personal device that leaves that path (BYOD off-network) is out of scope.
  • A refused personal session is not a transcript. The vendor stops the request. Nothing is sent to Arcjet.
  • Netskope may show no block event for Claude. It inserts a header; Anthropic returns the 403.
  • Codex API keys and Cursor CLI API keys can bypass a ChatGPT workspace header or Cursor team login. Pin login methods on the device, or treat those keys as a separate allowlist.
  • This complements Arcjet coding agent hooks and activity ingest. Hooks and Compliance govern the approved tenant. These restrictions keep personal accounts off the managed path.
Section titled “Related”