Securing and using Claude Code at scale

A common take from security folks at conferences is that 'security lives in CLAUDE.md' Unfortunately, that has nothing to do with how Claude Code actually enforces policy. If you're rolling out Claude Code across a company, CLAUDE.md is not your security layer. It's behavioral guidance — Claude reads it and tries to follow it. The thing that actually enforces is managed settings : a JSON file the Claude Code client honors regardless of what your devs put in their project or user settings. Where