8 min read
The Week Guidance Became Enforcement
The most useful sentence I read in this series so far came from a changelog on 25 August. Describing a new setting that lets an organisation give instructions to every session, Anthropic wrote that they are guidance the model follows, not an enforced control.
I called it the sorting question for any AI policy review, and I meant it as a criticism of the whole category. Then six days later two vendors quietly answered it, and the answers arrived in release notes rather than in an announcement.
TL;DR
- A fortnight ago a vendor described its organisation-wide instruction setting as guidance the model follows rather than an enforced control. Six days later the same product started refusing. Claude Desktop v1.44121.1, published 2 September, changes five settings from ones you can work around by asking again into ones that produce a flat refusal.
- The five cover Code sessions, artifact sharing, local stdio MCP servers, plugin sideloading and workspace folders over SSH. The word governance appears nowhere in the entry. It reads as a list of fixes, which is how the important changes in this category tend to arrive.
- Google shipped the same idea as an upstream block. Sensitive Data Protection content policies reached general availability on 31 August, inspecting in both directions and blocking, which puts enforcement upstream of the model and therefore outside its compliance.
- Two new proxy keys are read from device management or the local configuration file only, so a user cannot set them. That is the part that decides whether a control is a control.
The setting that started refusing
Claude Desktop v1.44121.1, published 2 September, changed what happens when an organisation sets isClaudeCodeForDesktopEnabled to false. Previously the setting expressed an intention. Now, when it is false, the app does not start a Code session even if asked directly, Preview no longer scans projects for a dev server, the computer is no longer offered for Remote Control, and a session requested anyway returns a flat statement that Code sessions are turned off by the organisation, in place of a retry prompt.
That is a small paragraph describing a large change of category. A setting that can be worked around by asking again is a preference. A setting that produces a refusal is a control.
The same release does it four more times. Live artifact sharing now follows the organisation’s Artifacts setting and its sharing policies, so members no longer see sharing options their organisation has turned off. Where managedMcpServers is configured with isLocalDevMcpEnabled false, plugins’ remote MCP servers connect and their local stdio ones stay blocked, which is a genuine boundary rather than a warning. Organisations setting disableSideloadFlags now get sessions in which none of the desktop’s plugins load at all, so their commands, agents and hooks are simply unavailable. And the allowedWorkspaceFolders policy was fixed so that it is actually applied to Code sessions over SSH, which is the sort of fix that tells you the policy had been advisory in at least one path.
Two more items in the same release are worth an architect’s attention. New egressProxyUrl and egressProxyPacUrl keys route the app’s and the agent’s traffic through a corporate HTTP proxy, or let a PAC file choose per request, instead of inheriting the operating system’s proxy settings, and on macOS and Windows the workspace follows the pinned proxy too. Crucially, both keys are read from device management or the local configuration file only, so a user cannot set them. That is what a control looks like when someone has thought about who is allowed to change it.
And conversation titles were added to the OpenTelemetry export, as a desktop_session_title_set event carrying the session title plus the Claude Code session ID to join on. The title text is included only when content capture is configured to include user prompts. Observability with an explicit content-sensitivity switch, rather than observability that quietly exports whatever it can reach.
Put those six items together and they describe one decision taken consistently across a release: the organisation’s configuration is now something the software honours rather than something it consults. That is a different product to the one that shipped a fortnight earlier, and nothing in the release notes says so. The word governance does not appear anywhere in the entry. It reads as a list of fixes and settings, which is how the important changes in this category tend to arrive.
Google shipped the same idea as a block, not a warning
On 31 August, Gemini Enterprise took Sensitive Data Protection content policies to general availability. You apply them to connectors, apps and Notebook Enterprise notebooks, and they inspect data for violating or unwanted content and block it. Both directions: the app is prevented from presenting sensitive material to users, and users are prevented from uploading files that contain it.
Read that against the ordinary shape of AI data governance, which is a system prompt asking the model not to do something and a report telling you afterwards how often it did. A content policy that blocks the upload is enforced upstream of the model entirely. It does not depend on the model’s compliance, which means it does not degrade when the model changes, when someone jailbreaks the prompt, or when a new surface is added.
Google also took federated data stores in Assured Workloads with FedRAMP High to general availability the same day, which is the same instinct expressed as a compliance boundary rather than a content one.
I do not think either vendor coordinated with the other, and I do not think either release was pitched as a governance milestone. That is exactly why it is worth naming. The interesting shifts in this category keep arriving as changelog entries.
Meanwhile the write scope kept growing
None of that should be read as the industry slowing down. In the same window Gemini Enterprise added write actions to three connectors in Public Preview: AirOps updating knowledge base document metadata, Airtable creating records in a table, Zoho Desk updating an event. Five new read-only data stores arrived alongside them, which is the familiar pattern of read first, write shortly after.
Claude Desktop added local scheduled tasks to the Code tab, including a /schedule command and a Scheduled page, extending to a second surface the pattern I flagged in the last edition when the agent acquired a trigger and a schedule.
Antigravity 2.12.0, on 2 September, introduced a /boost slash command that enhances thinking effort by using a multi-agent reasoning pipeline. Same release, a smaller and more telling item: General Settings now shows which of your projects override a setting, with a link straight to that project’s settings. In a week about whether settings are enforced, a tool that shows you where your settings are being overridden is quietly on theme.
The revert is part of the story
There is a detail I would normally skip and am not going to. Claude Desktop v1.44121.2, published the same day as v1.44121.1, fixed sessions on Windows being unable to run commands or fetch web pages by reverting the fix that shipped hours earlier in v1.44121.1.
A same-day revert of a same-day fix, published plainly rather than folded silently into the next build.
I raise it because the governance argument I have been making all year cuts both ways. If we are going to hold vendors to publishing their boundaries, we have to be reasonable about what it looks like when they publish everything, including the part where the previous entry was wrong. A changelog that contains no visible mistakes is not a changelog that describes reality. Salesforce did the same thing on the MarTech side this week, removing a release note that had claimed one of its agents could change a mobile setting it could not.
Publishing the retraction is the behaviour you want. Reading changelogs as if they were specifications is the behaviour that gets you hurt.
What I would do with this
Three things, and none of them takes a week.
Build the two-column table. Every AI policy your organisation has set, sorted into guidance the model is asked to follow, and controls the runtime refuses to violate. Most organisations will find the second column much shorter than they expected, and will find that some of the items they assumed were in it moved there only recently, in a release nobody read.
Then ask the vendor question that follows from it: which of your settings produce a refusal, and which produce a preference. It is answerable, it is now demonstrably answerable, and the answer is the difference between a control you can put in a risk register and a sentence you can put in a policy document.
Third, check who can change the setting. The most quietly important thing in the Claude Desktop release is that the two new proxy keys are read from device management or the local configuration file only. A control a user can turn off is a preference with extra steps.
The full record, with every dated item and source, is in AI Watch, Week 36.
Two vendors made the same question answerable in the same week: which of your settings produce a refusal. They answered it in release notes that never once used the word governance, and the settings that hold up are the ones a user cannot reach.
Sources
Anthropic
- Claude Desktop changelog. Version 1.44121.1 (2 September 2026) for
isClaudeCodeForDesktopEnabled, artifact sharing policy,managedMcpServersandisLocalDevMcpEnabled,disableSideloadFlags,allowedWorkspaceFoldersover SSH,egressProxyUrlandegressProxyPacUrl, the OpenTelemetrydesktop_session_title_setevent, and local scheduled tasks in the Code tab; version 1.44121.2 (2 September 2026) for the same-day revert. - Anthropic news. Claude Fable 5.1 and Claude Mythos 5.1, and Developing Enterprise Frontier Safeguards with our customers, both 1 September 2026; Improving our alignment and security efforts, 31 August 2026.
- Gemini Enterprise release notes. Sensitive Data Protection content policies GA and federated data stores in Assured Workloads with FedRAMP High GA, both 31 August 2026; new data stores and new connector write actions in Public Preview, 28 August 2026; Gemini 3.8 Flash GA, 2 September 2026.
- Google Antigravity changelog. Version 2.12.0, 2 September 2026, for
/boostand the settings-override visibility improvement.
OpenAI
- A milestone in expanding access to AI. 31 August 2026. Covered in full in the companion MarTech edition.
Cross-series
- Salesforce Winter ‘27 Release Note Changes. The week of 31 August 2026 removal of the Setup agent release note, cited here as the parallel retraction.
The digest behind each weekly article is produced through a structured AI-assisted scan of official release notes and product update sources. I review the output, verify the relevant signals and write the interpretation.
This article draws from the AI Tools Weekly Digest scans run on September 2 and 3, 2026, covering release notes and product updates from 28 August to 3 September across the major agentic work platforms. The dated record behind it is in AI Watch, Week 36.
If you find errors or gaps in coverage, I want to know. The process improves when the output is challenged.
