Does Your AI Plan Lock Anything, or Just Ask Nicely?

TL;DR: Before you buy an AI upgrade for security, find out which rules your tool locks and which it only asks people to follow. A lock can't be undone by the user. A request can. Ask your IT lead which is which, and get the answer in writing.

Key takeaways:

• A lock stops a person from changing a rule. A request asks nicely. Most AI policies are a mix, and few leaders know the split.

• Security teams raised the gap between AI policy and enforcement on four client calls between September 21 and October 5, 2026.

• Anthropic's documentation, read on October 22, 2026, says rules set by an administrator outrank anything a user sets for themselves.

• The same documentation lists limits. A personal account doesn't receive company settings, and some laptops can skip them.

• Four questions to your IT lead sort the locks from the requests in one meeting.

What's the difference between a lock and a request?

A lock is a rule the tool applies no matter what the person wants. A request is a rule you ask people to follow. They can sit on the same policy page and behave nothing alike.

Think of two doors. One has a lock. The other has a sign that says "Staff only." The sign works great until somebody's in a hurry.

Josh heard this from a security analyst at a credit union at the end of September. She said, "If I'm allowed to do something on my machine, then I will do." She wasn't blaming anyone. She was describing how people work. If we give people a setting they can change, we shouldn't be surprised when they change it.

Josh logged the same gap on four client calls between September 21 and October 5, 2026. A policy on paper, and nothing in the tool to back it up.

Why does the paid plan feel like the safe answer?

Because it's the one thing a leader can actually buy. A policy is words. An upgrade is a purchase order.

The better question is which of your rules the plan can lock. Anthropic answers part of that in public. Its settings documentation ranks rules from the administrator above everything a user or a project sets. Nothing a user sets overrides an administrator rule.

So does the more expensive plan give you the lock? For that feature, not necessarily. Anthropic's page on administrator-delivered settings, read on October 22, 2026, lists both Claude for Teams and Claude for Enterprise. Plans change, so read the page again on the day you decide. The upgrade may still be worth it for other reasons. Just don't let it stand in for the sorting.

What can a person still undo?

Plenty, and the vendor says so. Anthropic's own words call the administrator-delivered rules a client-side control on laptops the company doesn't manage. Here's what that means in plain terms:

• A personal account. Company rules only reach people signed in with a company account. Someone who signs in with a personal email gets none of them.

• An unmanaged laptop. If IT doesn't control the machine, a determined user has more room than you'd like.

• A different route to the AI. A user who points the tool at another provider skips the company rules.

• A first start with no connection. With no saved copy of the rules, the tool can run without them unless an administrator tells it to refuse.

A lock that skips the side door is a sign with extra steps. Good news: IT can close most of these. It has to know they're open.

What should you ask your IT or security lead this week?

Ask four questions, and ask them in one meeting.

1. Which of our AI rules can a person undo on their own laptop?

2. Has anyone actually tried to undo them?

3. Which rules are only requests, and who owns each one?

4. What would the upgrade lock that we can't lock today?

The second question is where the answers get interesting. Plenty of teams say a rule is locked because the setting exists. Few have tried to break it. Ask for one page, in writing, with two headings: locked and requested.

How does this fit with the rest of your AI rules?

Locks cover what you can stop. Watching covers what you can't. You need both, and a clear label on each rule tells you which one you're leaning on.

Josh wrote the practitioner version of this for security teams: which AI security settings your plan actually enforces. It has the setting names and the test to run. For the watching half, start with the post on whether anyone is watching how your team uses AI at work.

Frequently asked questions

Do I need to understand the settings myself?

No. You need to ask the question and read the answer. Locked or requested, with a name beside each requested rule.

Is a requested rule worthless?

No. A request with an owner and some evidence is a fine control for lower-risk work. It just shouldn't be filed under "locked."

Will locks slow my team down?

Only if you lock too much. Lock the things you'd stop on a bad day, like access to secret files. Leave the rest as clear, owned requests.

What if we use a different AI vendor?

Ask the same four questions. Each vendor documents its own limits, so ask for the page that says what an administrator can lock.

Locks and signs both have a place. Know which one you hung, and tell your team which is which.