Setting Up Claude Code for a Company: Permissions, Sandboxing, Rollout

Start with the settings hierarchy

Claude Code reads configuration from several layers. Understanding them is the basis of any company setup:

• Managed settings: a managed-settings.json deployed to a system-level location by IT. These take precedence and cannot be overridden by users or projects.
• Project settings: .claude/settings.json in the repository, shared with the team through version control.
• Local project settings: .claude/settings.local.json, personal and not committed.
• User settings: ~/.claude/settings.json for individual preferences across projects.

Put security-relevant rules into managed settings, team conventions into project settings and leave the rest to individuals. Distribute managed settings with your existing device management tooling so every machine gets the same baseline.

Permissions: allowlists and deny rules

Permission rules decide which tools Claude Code may use without asking. They are grouped into allow, ask and deny, and deny rules win. A sensible starting point:

1. Allow read-only and routine commands your team runs constantly, such as Bash(npm run test:*) or Bash(git diff:*).
2. Deny reading secrets, for example Read(./.env) and Read(./secrets/**).
3. Keep network fetches, package installs and deployment commands on ask, or deny them outright.
4. Disable the bypass-permissions mode in managed settings so nobody can switch off prompts on a production repository.

Expand the allowlist from real usage: when developers approve the same harmless command repeatedly, move it into project settings. Hooks add a second layer, since a pre-tool-use hook can inspect and block commands, for instance anything touching production credentials.

Sandboxing and isolation

Permission prompts depend on human attention, which fades after the fiftieth approval. Isolation does not. Claude Code offers a sandbox for shell commands that restricts file system writes and network access at operating system level. For stronger separation, run agents in development containers or cloud workspaces that hold no production credentials. Two rules hold regardless of the tooling: agents should never run with access to production secrets, and autonomous runs belong in environments you can throw away.

CLAUDE.md conventions and MCP servers

A CLAUDE.md at the repository root gives the agent project context at the start of every session: build and test commands, architecture notes, code style, things never to touch. Keep it short and factual, review changes to it like code and import longer documents by reference instead of pasting them in. A company-wide file can carry rules that apply everywhere, such as how to handle personal data. Our guide to AGENTS.md and CLAUDE.md covers structure and pitfalls.

MCP servers connect the agent to issue trackers, databases, documentation or internal APIs. Each server is a new data path and a new place where untrusted content can enter the prompt. Approve servers centrally, prefer read-only scopes, give them their own service credentials and restrict which servers may be used through managed configuration.

Cost control and rollout

You can authenticate Claude Code through a Claude Team or Enterprise plan, through API keys from the Claude Console, or through cloud providers such as Amazon Bedrock and Google Cloud Vertex AI. Each route has its own billing and limits, so pick one per organisation unit and set spend limits where the platform offers them. Claude Code can export usage metrics via OpenTelemetry, which lets you see usage per team before the invoice arrives. Habits matter as much as limits: starting fresh sessions for new tasks, choosing the model per task and keeping CLAUDE.md lean all reduce token usage.

A rollout that works in practice:

• Pilot with one or two teams for a few weeks, with managed settings already in place.
• Collect permission rules, CLAUDE.md patterns and failure cases from the pilot.
• Train every team before access, not after the first incident.
• Define review rules: agent-written code goes through the same pull request process as human code.

How jocapps can help

Our training brand neooutput runs hands-on Claude Code workshops and 1:1 consulting for engineering teams, in English or German, on-site or remote, including setting up permissions, CLAUDE.md files and review workflows on your own repositories. If you need a delivery team for custom apps, AI integration or production hardening, OnlineAppCreator is our ISO-certified B2B and B2G team in Germany. See our agentic coding workshops or book a free 30-minute intro call via the meeting planner.