Give developers a company account that is as easy to use as a personal one, then enforce it where tools allow: required organization login and an allowed provider list in managed settings, plus network and extension controls. Rules without an approved alternative just move the behavior out of sight.
Why people use personal accounts
Usually the company tool is slow to arrive, lacks a model they like, or needs a request form nobody answers. Treat personal account use as a signal about your approved options, not only as a violation.
Layer the controls
| Layer | Control | Example |
|---|---|---|
| Account | Company plan with SSO | Single sign-on for the assistant |
| Tool settings | Enforce organization login | Managed settings that require login to your organization |
| Provider | Allow only named providers | Managed provider allowlist |
| Device | Managed extension list | Approved editor extensions only |
| Network | Control destinations | Egress rules to approved AI endpoints |
| Policy | Clear written rule | Company accounts for company code |
Claude Code documents some of this: managed settings can require claude.ai logins to belong to a specific organization, and an allowedProviders list restricts which services a managed machine may reach Claude through. It also notes a limit: settings delivered only through server-managed settings reach accounts that are already authenticated, so for machines you can reach, deploy the keys through device management. Check the equivalent controls in each tool you approve, because they differ.
Make the company path easy
- Publish the approved list and a one-line way to request more.
- Answer requests within a few working days.
- Offer the same model choices where contracts allow.
- Provision accounts on day one for new joiners.
Handle existing use
Start with an amnesty period. Ask people to move work to company accounts, and ask them to rotate any secret that was ever pasted into a personal account. Then turn on enforcement. Review any exceptions in writing, with an expiry date.
Quick check
Can we block personal accounts entirely?
Partly. Settings and network rules reduce it, but a developer on a personal device can still use a personal account. Policy and a good alternative close the rest.
What about open source work on personal time?
Write it into the policy explicitly. Personal projects on personal devices are normally outside scope, company code is not.
Safeguard offers asset discovery and agent identity to help you see which tools and agents are active, plus a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
