Module 09 opening video · ~4 minutes · what breaks when a team shares one .claude, the settings stack that contains it, and the line between an agent that is code and one that is a system
client-project/.claude/
settings.json shared: allows, denies,
hooks, checked into git
settings.local.json one person's: git ignores it
agents/ subagent definitions
client-project/.mcp.json the team's MCP servers
client-project/CLAUDE.md instructions, edited by
three people this month
With one person this folder is a workspace.
With five it is a policy everyone inherits.{
"permissions": {
"allow": [
"Bash(npm test *)",
"Bash(git push *)" <- new
]
}
}
commit message: "settings"
The file is shared on purpose. Whoever pulls
it on Monday gets both rules.> clean up the branch and push
Squashing 4 commits...
Running: git push --force origin feature/intake
Pushed.
No prompt. The shared rule allowed any command
starting with "git push", and --force was part
of one. A colleague's unmerged branch is gone.
Discovered Tuesday.> figure out why the staging connection fails
Reading config/app.js
Reading config/secrets/staging.env
DB_HOST=stg-db.internal DB_PASS=Qm7...
The host is right; the password expired on
the 12th.
CLAUDE.md said "never read the secrets
folder." That sentence is advice to the
model. It weighed the sentence against a
direct request and chose the request. The
credential is now in the transcript.Do you trust the files in this folder?
client-project/
This project's settings define:
1 hook PreToolUse scripts/log-tool.sh
2 MCP servers tracker, docs-search
Hooks run scripts on your machine. MCP
servers are programs Claude can call.
You pulled them with the commit.
[ Yes, proceed ] [ No, exit ]| Rank | Level | Who owns it |
|---|---|---|
| 1 | managed settings | the organization |
| 2 | command line | you, this session |
| 3 | project local | you, this repo |
| 4 | shared project | everyone in the repo |
| 5 | user | you, everywhere |
A key set higher wins. Allow and deny lists merge across levels, so a developer can add to the organization's lists and cannot remove from them.
{
"permissions": {
"deny": [
"Read(./.env)",
"Read(./secrets/**)"
],
"disableBypassPermissionsMode": "disable"
},
"allowManagedPermissionRulesOnly": true
}
Same shape as settings.json. Different path:
one that needs administrator rights to write.
That is the enforcement.> /status
Setting sources:
Enterprise managed settings (file)
Project settings (.claude/settings.json)
User settings (~/.claude/settings.json)
Permission mode: default (Manual)
Bypass permissions mode: disabled by policy
One line per laptop. A machine that does not
show the first line has the file at the
wrong path, and the policy is not in force
there.> figure out why the staging connection fails
Reading config/app.js
Read config/secrets/staging.env
Blocked by permission rule:
Read(./secrets/**) (managed settings)
I can't read the secrets folder. The app
reads DB_HOST and DB_PASS from it. Tell me
which variable to check and I'll trace
where it is consumed.
The sentence in CLAUDE.md still explains
why. The rule is what stopped the read.| Question | release-notes.md | ticket-triage.md |
|---|---|---|
| Standing permissions beyond reading? | no | yes, posts comments |
| Runs without a person starting it? | no | yes, nightly |
| External effects? | no, a draft for review | yes, the client's tracker |
| Trail needed afterward? | no | yes, it sets priority |
| configuration: code review | a system: owner, log, inventory |
prompt.id 7f3a… user.id a91c… session.id 44e0…
12:04:11 user_prompt length 62
12:04:12 api_request sonnet in 8.1k out 410
12:04:13 tool_decision Read accept (rule)
12:04:13 tool_result Read ok 38ms
12:04:14 tool_decision Read reject (deny rule)
12:04:15 api_request sonnet in 8.9k out 190
12:04:16 assistant_response length 212
Prompt text redacted by default. The trail
shows a read was refused at 12:04:14 and
why, without copying the file into the log.| Phase | Ships |
|---|---|
| 1 · baseline | managed settings: secret denies, bypass lock, sandbox, telemetry endpoint |
| 2 · pilot | one team, one repo, shared settings reviewed like code |
| 3 · champions | the pilot's two most fluent people write the guide, hold office hours |
| 4 · fleet | everyone, baseline unchanged |
| ongoing | weekly tool_decision review, a named owner per registered agent |
Deloitte, April 2026: 21 percent of organizations have a mature governance model for agents. 74 percent expect at least moderate use by 2027.