How do teams manage Claude Code and Codex across their developers?

Summary

• Route Claude Code and Codex through Unity Gateway. Every request then goes through a Databricks model service, Unity Catalog controls who can use which models, and the gateway enforces limits and records usage and cost, with no provider API key on the developer's machine.
• Developers launch the agents with the open-source ug CLI (ug claude, ug codex). Admins can publish one shared coding agent configuration per workspace (Beta).
• Cost controls are rate limits in requests or tokens per minute, plus monthly budgets with shared and per-user thresholds that alert or block.
• Visibility comes from the system.ai_gateway.usage table, the dashboard's Coding Agents tab and unified tracing (Beta).
• Each tool keeps its own admin controls, such as Claude Code managed settings and Codex requirements.toml. The gateway adds the shared layer for models, spend and audit.

How do teams manage Claude Code and Codex across their developers?

Run both tools through Unity Gateway and govern them like any other AI service. Instead of each developer pasting a provider API key into a tool, every request routes through a Unity Gateway model service. Unity Catalog controls who can use which models, and Unity Gateway enforces limits and records usage and cost. Each tool's own admin settings still decide what the agent may do on a machine.

What can admins control through Unity Gateway?

Need	Control	Detail
Who can use which models	EXECUTE on a model service	Granted to users or groups in Catalog Explorer
Request volume	Rate limits	Requests or tokens per minute, for a service, per user or for groups. None by default. Over the limit returns HTTP 429
Spend	Monthly budgets	Shared and per-user thresholds that send an alert, block usage, or both
Consistent setup	Coding agent configuration (Beta)	One published configuration per workspace, applied with ug configure
Tools	MCP services	Grants, tool selection and service policies (Beta)
Sensitive data	Service policies (Beta)	The built-in Sensitive Data Detection policy can block or redact configured data types, such as credit card numbers, in model requests and responses
Usage records	system.ai_gateway.usage	By requester, model and workspace. Session metadata is in Public Preview
Activity and traces	Usage dashboard, unified tracing (Beta)	Coding Agents tab, plus client-side traces from Claude Code and Codex

How do developers connect?

You need Python 3.12 or later and uv. Install the launcher and start either agent:

uv tool install git+https://github.com/databricks/unity-gateway
ug claude
ug codex

On first run, ug asks for your workspace and signs you in, then opens the agent with its usual interface. In most agents, /model switches models during a session. The model services you expose must match each agent's API: Claude Code requires the Anthropic Messages API, and Codex requires the Open Responses API or the OpenAI Responses API.

How do admins keep setups consistent?

A workspace admin enables the Unity Gateway Managed Configuration preview, then publishes one configuration under Unity Gateway > Govern > Agent configuration, or with databricks api post /api/ai-gateway/v2/coding-agent-configs. It sets the enabled agents and the default agent, each agent's model source and defaults, MCP servers, skills, and gateway features such as Smart Routing and tracing. Each agent gets exactly one model source: a static list of model services (recommended), a model provider service, or a Unity Catalog location. Developers pick up changes when they launch through ug, and ug configure refreshes immediately.

What do Claude Code and Codex enforce on their own?

• Claude Code: managed settings apply above every other level. Admins deliver them as a managed-settings.json file, through MDM or OS-level policy, or from server-managed settings in the claude.ai admin console.
• Codex: requirements.toml (for example /etc/codex/requirements.toml) enforces approval policies, sandbox modes and which MCP servers users can enable. Cloud-managed requirements come from Agent Security in the Admin Console.
• Shared instructions: Codex reads AGENTS.md files, and Claude Code can read an AGENTS.md in place of a CLAUDE.md, so one file can serve both.

What does a rollout look like?

1. Choose model services that match each agent's API (Databricks-hosted models are ready-to-use model services), and grant EXECUTE to the developer groups.
2. Set rate limits on the service, per user if needed.
3. Have an account admin create a monthly Unity Gateway budget with a per-user threshold and Block usage.
4. Publish the coding agent configuration. Link the budget ID if you want developers to see their spend with ug usage, which needs the Enhanced Unity Gateway preview.
5. Ask developers to install ug and launch with ug claude or ug codex.
6. Review the Coding Agents tab and system.ai_gateway.usage.

FAQs

Can developers use their own Claude subscription?

Yes, for Claude Code only, in Beta. Unity Gateway relays each caller's Anthropic OAuth token and stores no API key. Requests are billed against the caller's subscription, while Unity Gateway governs access, routing and usage.

Which of these features are in Beta?

Unity Gateway is generally available, but some capabilities remain in Beta, including service policies. The coding agent configuration, Smart Routing and the unified trace table are in Beta and need their previews enabled.

Can we add approval prompts and per-user spend caps inside a session?

Omnigent adds ALLOW, ASK or DENY policies at server, agent and session level, including per-user daily cost budgets. It is open source with status alpha, and in Beta on Databricks.