Recommended Claude settings with diskret.ai

diskret.ai protects personal data only on the path that goes through it. If Claude can also reach the same system through a direct connector, a user can take that route and skip the gateway. These settings close that gap. They are set in Claude’s admin settings, not in diskret.ai, and the labels may change as Anthropic updates the admin console.

Who: a Claude organization owner or admin.

1. Remove direct connectors to systems diskret.ai fronts

If you have connected a system to diskret.ai (your CRM, Gmail, a file store), remove any direct Claude connector for the same system, and do not approve member requests to add one.

• Keep diskret.ai as the connector for that system.
• Check the connector list after you roll out diskret.ai. Old direct connectors are easy to forget, and each one is an unprotected way in.
• Members can request other connectors. Review those requests with the same question: does diskret.ai already cover this system?

2. Turn off “Always allow” for tools that make changes

Claude lets an admin decide whether members may set a tool to Always allow. Turn that off for tools that make changes.

• In Claude, set the diskret.ai connector’s write tools to Ask (or Block). A user then confirms each change in Claude.
• This is a second layer. diskret.ai has its own policy for write and delete tools per team: closed, needs approval, or open. Claude’s setting applies to the whole organization; diskret.ai’s applies per unit and can send an action to a named approver.
• diskret.ai tells Claude which tools only read and which can change or delete data (readOnlyHint and destructiveHint, taken from diskret.ai’s own classification), so Claude sorts them into its read-only and write groups for you.

3. Set a default restriction for new tools

Claude has a default for tools you have not configured yet, including tools added later. Set it to Ask or Block, not Always allow.

Upstream systems add tools over time. With a restrictive default, a new tool does nothing until an admin has looked at it, in Claude and in diskret.ai.

4. Add organization instructions

Claude’s organization instructions apply to every conversation (the limit is a few thousand characters). Short, plain rules work best. A starting point:

Use the diskret.ai connector for company systems. Do not ask for, paste or retype personal data (names, national IDs, health or salary details) into the chat yourself. Names and values in tool results may appear as references: keep them as they are.

When a task needs a document, do not ask the user to upload it. Ask them to share it in the file system connected to diskret.ai (for example Google Drive or OneDrive) and fetch it through the diskret.ai connector, so personal data in it is handled by the gateway.

The second rule matters because a file attached to a chat goes straight to the model. A file fetched through diskret.ai passes the same pseudonymisation as every other tool result.

Organization instructions guide behavior. They do not enforce anything, so keep the settings in steps 1 to 3 as well.

What these settings do not cover

• Uploads. Claude Team has no admin setting that stops members from attaching files to a chat. Instructions and training are the only lever there.
• Other Claude surfaces. Per-tool permissions apply to claude.ai, Claude Desktop and Claude Code cloud sessions. They do not apply to the Claude Code command line, desktop extensions or the API. Set up those clients separately.
• Monitoring. diskret.ai cannot read your Claude settings, so it cannot tell whether they are in place. Review them yourself after changes.