Common Measure
Menu

Bring your team onto Common Measure Hub.

One owner sets up the organisation. Each member connects their own machine and chooses, project by project, what reports to Hub.

Owner

Set up your organisation

You need the access email from Common Measure and a browser. Your own machine is optional: to report your own work, follow the member track after step 4.

Sign in

Open the link in your access email. It opens the Hub sign-in page with your address filled in. Choose Email me a sign-in link, open the new email, and choose Sign in as followed by your address. The sign-in link works once and expires after 10 minutes.

Checkpoint. Hub opens on Create your organisation.

Create the organisation

Enter the organisation’s name and choose Create organisation. You become its owner.

Checkpoint. Hub opens Policy.

Publish a policy

Choose Create policy, keep General-purpose agent and continue to Directories. Leave Add a path rule (advanced) closed: members choose reporting per project, and you approve each one in step 7. Choose Use this policy, then Review changes and Publish.

Checkpoint. Policy lists the published revision, and API keys does not show “Publish a policy before managed connection”. Members’ machines take this policy when they connect.

Path rules are for a convention that must hold on every machine, such as refusing sources wherever the path contains /clients/. A firm-wide path convention; Policy distribution.

Invite members

Open Team. Under Invite someone, enter a colleague’s email address, choose the role Member and choose Send invite. The invite email links them to the member track. An invite expires after 14 days.

Checkpoint. The address is listed under Pending invites until they accept, then under Members.

Provider keys

Members’ own machines use their own keys, in credentials.env on each machine (Add a provider key). Keys you save under Suppliers are released only to a hosted edge; do not authorise a member’s laptop there, because a local edge never fetches them.

Checkpoint. On a member’s machine, commonmeasure credentials shows the supplier as configured.

Switch off each host’s own web access

Agents can also read the web through their host’s built-in tools. With the Claude Code plugin on Claude Code 2.1.287 or later, Claude Code’s own WebFetch and WebSearch already go through Common Measure. Other built-in tools are not mediated; switching them off leaves Common Measure as the only web path. For now this is a manual step in each vendor’s admin console; Hub will generate these settings later.

Claude apps
claude.ai organisation settings → Capabilities → Web search off. Team and Enterprise.
ChatGPT
Admin console → Permissions & roles → Web search off, per workspace or role. Enterprise and Edu.
Microsoft 365 Copilot
Cloud Policy Allow web search in Copilot, per user or group.
Codex
Agent Security: set allowed_web_search_modes to [] (disabled). Business and Enterprise; on other plans, a requirements file delivered by MDM.
Claude Code
Deny the built-in tools with {"permissions": {"deny": ["WebFetch", "WebSearch"]}}. On Team or Enterprise, paste it in claude.ai Admin Settings → Claude Code → Managed settings. On other plans, deliver it as a managed-settings.json file through your device management (MDM). These rules govern machines without the plugin’s routing; a routed call is governed by source policy and the permission for context_fetch and context_search instead.

Checkpoint. Asked to search the web, the host’s agent uses context_fetch or context_search, or says web access is unavailable.

These switches block the host’s own web tools. They record no licence and report nothing to content owners; Common Measure does that for the reads that go through it.

Claude Code outside Team or Enterprise shows “Managed settings (remote): not fetched — requires an Enterprise or Team subscription”. That is expected, not an error: settings delivered as a file or through MDM still apply.

Approve projects

When a member enrols a project for Hub reporting, it appears under Project reporting as Pending approval, with the project name they chose. Hub never sees the folder’s path. Check the name with the member, then choose Approve reporting. Tell them to sync (member step 5).

Checkpoint. The project shows Approved. Revoke reporting stops it at any time.

A machine connecting is not a request for approval. Only projects wait for you. Project approval covers expiry and opting out.

See reports

Open Fleet evidence. After a member works in an approved project and their machine relays, it shows pages Retrieved and Grounded over the last 30 days, recent sessions by edge, and the top source hosts.

Checkpoint. A session appears under the member’s edge name. Before any delivery the page says “No evidence received yet.”

Prompts, answers, page content, project folders and the addresses of refused reads stay on members’ machines. Fleet evidence.

Microsoft 365, with Common Measure

People who work in Word or Copilot rather than a coding agent use a hosted edge instead of their own machine. Common Measure sets it up with you and registers it under Hosted edge; each person then signs in from the host and enrols nothing. Supplier keys under Suppliers are for this edge. Contact us to arrange it.

Member

Join your organisation

You need the invite email, a browser, and Claude Code or Codex on the computer where you work. Each step gives a sentence to paste into your agent and what you should see. The agent will ask before it runs each command; approve it. If you prefer a terminal, each step also has the commands.

There are two kinds of enrolment. You enrol this machine once (step 3). You enrol each project separately (step 4), and only projects wait for the owner’s approval.

Accept the invite

Open the link in your invite email. Sign in with the address that received it: enter it, choose Email me a sign-in link, open that email and choose Sign in as. Use the same browser for both links. Then choose Accept invite.

Checkpoint. The page reads Join followed by your organisation’s name before you accept, and Hub opens Fleet evidence after.

Install Common Measure

Open Claude Code or Codex in any folder and paste. The sentence carries the commands, so it works when your organisation has switched off the app’s own web access.

Paste into your agent
Install Common Measure and connect it to this app. Run: curl -fsSL https://github.com/commonmeasure/commonmeasure/releases/latest/download/install.sh | sh. Then run ~/.local/bin/commonmeasure install claude and ~/.local/bin/commonmeasure doctor claude, using codex in place of claude if this app is Codex. Show me the doctor output.

Checkpoint. The agent shows doctor output with your app listed as ✓ registered. Quit and reopen the app so it loads Common Measure.

The commands
Terminal
curl -fsSL https://github.com/commonmeasure/commonmeasure/releases/latest/download/install.sh | sh
export PATH="$HOME/.local/bin:$PATH"
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc
commonmeasure install claude
commonmeasure doctor claude

For Codex, use codex in place of claude. Install Edge is the full reference.

Enrol this machine (once)

In Hub, open Enrol this machine. Enter an Edge name that says whose machine it is, such as “Sam’s laptop”, and choose Mint enrolment token. Hub shows a command starting commonmeasure connect. It works once, for 15 minutes. Copy it and paste into your agent:

Paste into your agent
Run this Common Measure command exactly as written and show me what it printed: [paste the command from Hub here]

Checkpoint. The output names your organisation and a policy revision. This machine is now enrolled; nothing about the machine waits for approval.

The commands

Paste the command from Hub into Terminal and press Return. It looks like this, with your own token:

Terminal
commonmeasure connect https://hub.commonmeasure.ai --token et_… --managed

If the token expired, mint a new one. If the output says no policy is published, ask the owner to publish one, then run commonmeasure policy sync. API keys covers recovery.

Steps 2 to 4 for one project, in one line

The installer can take the same token and do steps 2 and 3 itself, then enrol the folder it runs in for Hub reporting. Run it only in a project you want to report, with your own token:

Terminal
curl -fsSL https://github.com/commonmeasure/commonmeasure/releases/latest/download/install.sh | sh -s -- --connect https://hub.commonmeasure.ai --token et_…

It prints one line per step. Run from your home directory, it enrols no project, and each other project still needs step 4. A project waits for the owner’s approval as in step 4.

Enrol a project (each project)

Open your agent in the project’s folder. In Claude Code, that is the folder you started it in; in the Codex app, the project you opened. Paste, with your own project name:

Paste into your agent
Enrol this project with Common Measure for Hub reporting, including its existing history. Call it Client research.

For a project that must not report, ask for local recording instead:

Paste into your agent
Enrol this project with Common Measure for local recording only. Call it Private notes.

Checkpoint. For Hub reporting the agent reports approval_pending: the project waits for the owner. Local recording shows local_only and needs no approval.

The folder’s path stays on your machine; Hub sees the name you chose. Reporting covers the folder and everything inside it, including earlier records when you include history. Another Git worktree of the same repository is a separate project.

The commands

In Terminal, cd moves into a folder: type cd and a space, drag the project folder onto the Terminal window, and press Return. Then run:

Terminal
commonmeasure enrol --name "Client research" --reporting hub --include-history

Use --reporting local for local recording. With the Claude Code plugin, /commonmeasure:enrol asks the same questions; with Codex, $commonmeasure-enrol. Enrol a project directory.

After the owner approves

When the owner tells you the project is approved, paste in the same project:

Paste into your agent
Sync my Common Measure project enrolment and tell me whether reporting is permitted.

Checkpoint. reporting is permitted. Start a new session in the project and work as usual.

The commands
Terminal
commonmeasure enrol --sync

Check what was recorded

After some work, paste:

Paste into your agent
Show me my latest Common Measure session record, and what would be sent to Hub if the relay ran now.

Checkpoint. The agent shows the session’s crossings (commonmeasure session) and the events that would leave (commonmeasure relay --dry-run). Claude Code sends them when a session ends; the owner then sees your edge name under Fleet evidence.

The commands
Terminal
commonmeasure session
commonmeasure relay --dry-run
commonmeasure relay

Your source policy still applies, and records from a confidential or local-only folder never leave. What arrives and what does not.

Codex only: the background relay

Codex does not tell Common Measure when a session ends, so a background relay sends records on a timer. Without it, Codex refuses sources whose licence requires usage reporting. On a Mac, paste:

Paste into your agent
Install the Common Measure background relay on this Mac and show me commonmeasure doctor codex.

Checkpoint. doctor shows the background relay as running.

The commands
Terminal
commonmeasure service install relay

On Linux, run commonmeasure relay --every 300 under your service manager. Relay without a session end.

Reference