PRODUCTION SCENARIO
An organization runs Claude Code on 200 machines across many repositories. Security wants its data-handling rules loaded in every session on every machine, and individual settings must not be able to skip them.
Where should the rules be placed?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: A CLAUDE.md at the managed policy path, deployed by MDM to every machine
A managed policy CLAUDE.md loads before user and project memory in every session on the machine and is the one location the docs say individual settings cannot exclude. A committed project file covers only its own repository and can be skipped with claudeMdExcludes, which a CI check on pull requests does not prevent. A provisioned file in the home directory is ordinary personal configuration the developer can edit. Symlinked rules resolving outside the working directory wait on an external-import approval.
Official Source: https://code.claude.com/docs/en/memory ↗