[BUG] Organization-shared cloud environments can't use Custom network access / Allowed domains, contrary to documented field parity

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

The Network access selector behaves differently depending on where a cloud environment is created.

In a personal environment (environment selector → Add/Edit environment), all four documented access levels are offered, and choosing Custom reveals the Allowed domains field.

In an organization-shared environment (admin settings → Cloud environments), the Custom level is not available, so there is no way to define an allowlist for a shared environment. Owners and admins are limited to None / Trusted / Full.

This contradicts the documentation, which states that shared environments have the same fields as personal ones:

Create, edit, and archive shared environments. Each one has the same fields as a personal environment: a name, a network access level, environment variables, and a setup script. — https://code.claude.com/docs/en/claude-code-on-the-web#organization-shared-environments

The linked "network access level" section defines four levels including Custom:

Custom — Your own allowlist, optionally including the defaults — https://code.claude.com/docs/en/claude-code-on-the-web#access-levels

Why this matters

Standardizing one configuration for the team is the stated purpose of shared environments, and for us it's important to also standardize network access (private package registry and docs). The only alternative we have is granting "Full access" which we don't want for security reasons.

What Should Happen?

The admin Cloud environments page should offer the same four network access levels as the personal environment dialog, and selecting Custom should reveal the same Allowed domains field, including the "Also include default list of common package managers" checkbox.

Alternatively, if the omission is deliberate, the documentation should say so explicitly in the Organization-shared environments section and explain the reasoning, rather than asserting field parity.

Error Messages/Logs

Steps to Reproduce

As an Owner or Admin on a Team plan:

1. Go to https://claude.ai/code, open the environment selector, and select Add cloud environment.
2. In the Network access selector, note that Custom is offered, and that selecting it reveals an Allowed domains textarea and "Also include default list of common package managers" checkbox. Cancel.
3. Go to https://claude.ai/admin-settings → Cloud environments.
4. Create or edit an organization-shared environment.
5. Open the Network access selector. Custom is not offered, and there is no Allowed domains field.

Claude Model

None

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.220 (though unrelated because this concerns the Admin UI)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

Personal environment dialog:

<table>
<tr>
<td> <img width="540" height="1057" alt="Image" src="https://github.com/user-attachments/assets/85c2cb0a-65ff-422b-b856-e2e17dbbcb6c" />
<td> <img width="539" height="937" alt="Image" src="https://github.com/user-attachments/assets/4ad9a174-64b9-41cc-be77-ae996fa40c2c" />

</table>

Organization-shared environment dialog:

<img width="541" height="667" alt="Image" src="https://github.com/user-attachments/assets/f46adaf5-f905-475f-bde4-a9d95baccb4b" />