Framework how-tos

How to Deploy and Govern AI Agent Skills Across Claude Code, Cursor and Codex

An enterprise rollout plan for agent skills: deliver approved skills to each department over MCP, connect sign-in, require approval for risky publishes, keep permissions separate, and know which skill is on which computer.

Updated Oct 14, 2026

Last reviewed: October 2026

By Contro1 team (Agent control for organizations)

To roll out agent skills across an organization: connect your identity provider so departments match your directory, connect each coding agent to Contro1 (Claude Code with contro1 connect, Cursor and Codex as a remote MCP server), import and scan the skills you want to standardize, push them to the whole organization, a department, a person or one agent, require an administrator for risky publishes, and install the contro1 CLI on each computer so you know which skill is on which machine. Claude Code can then be locked to approved skills with a managed setting. For Cursor and Codex the control is detection, the same day. Skills tell agents how to work; grants in the Action Gateway still decide what they may do.

Key takeaways

Treat skills like internal software: one library, named owners, versions, review before publishing, and a record of who received what.
Deliver skills over MCP from Contro1, so the same approved version reaches Claude Code, Cursor and Codex without copying files between laptops.
Assign by organization, department, person, or agent. The most specific assignment wins, and production agents can be locked to the versions they have.
Be precise about enforcement: Claude Code can be locked to approved skills with a managed setting; for Cursor and Codex, the control is daily detection and alerts.
A skill never grants permission. What an agent may actually do is decided by its grants in the Action Gateway, checked at the moment it acts.

The questions an enterprise asks before rolling out skills

A single developer can drop a SKILL.md into a folder and move on. An organization with hundreds of people across Sales, Support and Engineering has different questions, and they are the same questions it already asks about any software it deploys.

Question	Short answer
How do we get the same skills to three departments, in three different coding agents?	Publish each skill once in Contro1 and assign it to a department. Every connected agent receives it over MCP, whichever coding agent it runs in. See the rollout plan
How does this connect to our SSO and directory?	People sign in with your SAML or OIDC provider, and your directory groups become the departments you assign skills to. See step 1
Who may publish a skill, and who approves a risky version?	Each skill has a named owner. A version the scanners rate dangerous needs an administrator, and you can require one for more. See the example policy
How do we stop a skill from giving an agent more power than it should have?	A skill cannot. What an agent may do is decided by its grants in the Action Gateway, checked when it acts. Why they are separate
How do we know which skill is on which employee's computer?	The contro1 CLI reports every skill on each computer daily, and the Skills page lists them with who has them. See coverage
Can we block unapproved skills?	In Claude Code, yes, with a managed setting. In Cursor and Codex, they are detected and reported the same day. Compare the three

What each coding agent supports

All three load skills in the open Agent Skills format, and all three can connect to Contro1 over MCP. They differ in how they connect and in whether an organization can stop them from loading local skills. Plan the rollout around those differences rather than assuming one control works everywhere.

	Claude Code	Cursor	Codex
Connects to Contro1	contro1 connect claude-code: the owner approves once, and a local Contro1 service holds a key that cannot be exported.	Add Contro1 as a remote MCP server and sign in with OAuth. It acts as the signed-in person.	Add Contro1 as a remote MCP server and sign in with OAuth. It acts as the signed-in person.
Receives organizational skills	Over MCP: skills extension, connection instructions, tools, and one prompt per skill.	Over MCP, through the connection instructions and the list_org_skills and get_org_skill tools.	Over MCP, through the connection instructions and the list_org_skills and get_org_skill tools.
Local skills found and scanned	Yes, with the contro1 CLI daily report, including installed plugins and project skills through a hook.	Yes, with the contro1 CLI daily report.	Yes, with the contro1 CLI daily report.
Local skills can be blocked	Yes, with the managed setting strictPluginOnlyCustomization, deployed through Intune, Jamf, Group Policy, or the managed settings file.	No equivalent documented setting today. The control is detection and an alert the same day.	No equivalent documented setting today. The control is detection and an alert the same day.

Claude Code docs: Deploy managed settings · Claude Code docs: Skills · OpenAI: Codex admin setup and managed configuration

A rollout plan for three departments

The plan below takes a company from scattered skills on laptops to one governed library, starting with Sales, Support and Engineering. Each step can be done in a day for a first department and then repeated.

Connect sign-in and the directory

Turn on single sign-on with your SAML or OIDC provider and import people and groups, so departments and managers in Contro1 match your directory. SCIM keeps them in sync on the Enterprise plan.

Connect the coding agents

Run contro1 connect claude-code on each computer that runs Claude Code. In Cursor and Codex, add the Contro1 MCP server and sign in. Every connected agent appears in the inventory with its owner and department.

See what is already installed

Each person installs the contro1 CLI once and runs contro1 skills schedule. Within a day you have every skill on every reporting computer in one list, scanned, with the riskiest first.

Build the library from what works

Import the good skills you found, or paste a GitHub link: Contro1 pins the commit and scans before saving. Give each skill a named owner and, where useful, a reviewer.

Assign by department

Push company-wide basics to the whole organization and a pack to each department. Lock the skill versions of agents that do real work for customers, so a publish never moves them by surprise.

Decide what needs an administrator

By default a dangerous scan needs an administrator. Raise it to anything pushed to the whole organization, or to every publish. On Enterprise, set the policy per department.

Close the side doors

Set local skills to Only skills from Contro1, and deploy the Claude Code managed setting. Anything installed anyway is flagged as outside policy, and the person, their manager and the administrators are told.

Keep permissions in the gateway

Grant each department's agents the application actions they need, and mark the sensitive ones as approval-required. The skill describes the procedure; the grant decides whether the agent can carry it out.

Organizational skills documentation · Connect an agent to Contro1

Example: Sales, Support and Engineering

The same library serves all three departments, with different packs and different approval boundaries. This is an example policy for a fictional company, not a product default.

Department	Skills it receives	Who approves a risky skill change	Actions that still need a person
Whole organization	How we write to customers; security basics; how to ask for approval.	An administrator for anything pushed to everyone.	Defined per department below.
Sales	Prospect research; CRM note format; discount policy.	An administrator for a dangerous scan.	External email; a discount above 10%.
Support	Refund policy; escalation playbook; tone for angry customers.	An administrator for a dangerous scan.	A refund above the policy threshold; an account change.
Engineering	Code review checklist; release procedure; incident runbook.	An administrator for every publish, because skills here can run commands.	A production deployment; a change to access.

Skills and permissions are separate on purpose

A skill is guidance. It can tell an agent to send a summary from finance@, but it cannot give the agent access to that mailbox. Whether an agent may send that email or issue that refund is decided by its grants, and checked again at the moment it acts. Revoking a grant takes effect immediately, even for an agent holding a day-old copy of its skills.

This is what makes a skills rollout safe to scale. A careless or malicious skill can still try to steer an agent, so it is scanned and reviewed. But it cannot expand what the agent is allowed to do, and the attempt is recorded where the action is refused or held.

Action Gateway: grants, approvals and evidence · AI agent gateway explained

Know which skill is on which computer

Two lists answer the question auditors ask. The Skills page shows every skill in the organization, from the library and from computers, with who added it, their department, how many agents it reaches, and when it was last seen. Scan agents shows every connected agent that runs on a computer and whether its owner's computer reports every day, with one email per person telling them exactly what to run when it does not.

For library skills, the publish preview names the agents a change will move, the ones protected by a locked version, and which agents actually loaded the skill in the last 30 days. Every publish, push, approval and dangerous-skill confirmation is written to the audit log.

Agent skills security: find, scan and control skills on employee computers · Enterprise agent skills registry

What to measure in the first 30 days

Measure	Why it matters
Share of agents whose computers report every day	Coverage is the precondition for every other number.
Skills found outside the library, and how many were removed or imported	Shows whether people are moving to the approved source.
Dangerous skills found and time to removal	The security outcome a CISO will ask for.
Claude Code agents marked Approved skills only	How far the enforceable part of the rollout has reached.
Publishes that waited for an administrator, and how long they waited	Tells you whether the approval policy is protecting or blocking.

Frequently asked questions

How do I distribute agent skills to different departments?

Publish the skill once in Contro1 and push it to the whole organization, a department, a person, or one agent. Agents receive it over MCP on their next Contro1 tool call. When several assignments cover the same skill, the most specific wins: agent, then department, then person, then organization.

Can I block unapproved skills in Cursor and Codex?

Not with a documented setting today. Claude Code can be locked to approved skills with the managed setting strictPluginOnlyCustomization. For Cursor and Codex, the contro1 CLI reports installed skills daily, each one is scanned, and a skill outside policy alerts the person, their manager and the administrators the same day.

Who approves a risky skill before it reaches agents?

An administrator. By default a skill the scanners rate dangerous needs one; the policy can also require an administrator for anything pushed to the whole organization, or for every publish and push. On the Enterprise plan the policy can be set per department.

Does a skill give an agent new permissions?

No. A skill tells the agent how to do a task. What it may actually do is decided by its grants in the Contro1 Action Gateway and checked at the moment it acts, so a skill can never expand an agent's authority.

How do skills connect to our SSO?

People sign in to Contro1 with your SAML or OIDC provider, and people and groups are imported from your directory, so departments, managers and reviewers match it. Skills are then assigned to those departments and people. SCIM provisioning is available on the Enterprise plan.

One skill library for every department and every coding agent.

Start free with Contro1: import one skill, push it to one department, and see which agents loaded it. No credit card required.

Get started with Contro1

Related resources

Organizational skills

Push skills to every agent over MCP, see and scan every skill employees install, and allow only skills from Contro1. With versions, rollback and approvals.

Agent Skills Security: How to Find, Scan and Control the Skills on Employee Computers

Find every Claude Code, Codex, Cursor and NanoClaw skill on employee computers, scan each one, get alerted to dangerous skills, and allow only approved ones.

Enterprise Agent Skills Registry: Share AI Skills Across Your Organization

Enterprise agent skills registry: push skills to every agent, see and scan every skill employees install, and allow only skills from Contro1.

Contro1 Action Gateway

Choose the applications your organization approves, decide who may do what, and connect one MCP. Every person and agent gets exactly their access, and every action is recorded on their name.

Best AI Agent Control Plane Tools: 2026 Enterprise Comparison

Compare the best AI agent control plane tools for 2026, including Contro1, Microsoft Agent 365, Galileo Agent Control, ValidMind, Permit.io, and observability platforms. See what each layer controls before an agent acts, from MCP and API access to human approvals and agent skills.