PRODUCTION SCENARIO
An organization runs Claude Code across 50 repositories and can deploy files to every developer machine by MDM. Build instructions differ by repository. The same tool restrictions must hold everywhere, they have to block the calls rather than discourage them, a contributor with commit access must not be able to edit them away, and a developer must not be able to drop them from their own machine either.
Which configuration split matches those requirements?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: Build steps in each repository's CLAUDE.md, restrictions in managed settings
Managed settings are deployed by administrators and cannot be overridden by user or project settings, which is the only placement that survives both a contributor with commit access and a developer editing their own files. A repository's committed settings.json is right when repositories need different restrictions and everyone who can push is trusted to keep them. User settings are right for a personal working preference, and the developer who owns the file can delete the rules. An organization-managed CLAUDE.md does reach every machine and is right for guidance, but CLAUDE.md is context rather than an enforcement layer, so it steers and does not block.
Official Source: https://code.claude.com/docs/en/permissions ↗