admin-capability-lockdown

An organization-level mod that (1) withholds the http and process nouns from $ so no plugin seated beneath it can reach the network or spawn processes, (2) refuses plugins at plugin.register by name allowlist and by the $ calls their source declares, and (3) optionally withholds or guards the Bash tool.

Only (1), (2) and the "deny" shell policy are real boundaries. The "guardrail" shell denylist is bypassable by design and is labelled as such.

SEATING. Withholding and refusal only bind the plugins BENEATH this one. Put it in the prepend tier through managed settings, e.g.

"prependPlugins": ["admin-capability-lockdown@acme-tools", "sec-default@builtin"]

so it is outermost: its engine.create step returns last (its withholding wins) and it judges every plugin.register after it. Loaded with --plugin-dir it sits in the user tier and only binds plugins listed after it.

If a check itself fails (it throws or runs out of its time budget), a user plugin is refused and a guardrail-mode command is denied, never let through unchecked. The engine.create step has no time budget; a failure there fails the load.

Options

  allowedPlugins: string  plugin names that may register, comma-separated (unset = any name)
  refuseCalls:    string  a user-tier plugin whose source calls any of these is refused, comma-separated
                            (default: the withheld nouns' calls, e.g. "http.fetch", "process.run")
  shellPolicy:    "deny" | "guardrail" | "allow"  (default "deny")

Declared in .claude-plugin/plugin.json (userConfig). Set them in /config, in user settings (~/.claude/settings.json, not project settings), with --settings <file> or in managed settings:

{ "pluginConfigs": { "admin-capability-lockdown@skills-dir": { "options": { } } } }

Install

npx claude-code-templates@latest --mod enterprise/admin-capability-lockdown
claude

It is written to .claude/skills/admin-capability-lockdown/, which Claude Code auto-loads as admin-capability-lockdown@skills-dir. For one session with hot reload: claude --plugin-dir .claude/skills/admin-capability-lockdown. claude plugin validate .claude/skills/admin-capability-lockdown prints every event it hooks and every $ call it makes.

Requirements. Mods are on by default in Claude Code 2.1.287+. Typed against Anthropic's declarations: https://github.com/anthropics/claude-code/tree/main/mods