A state revenue agency is rolling Claude Code out to 140 engineers who work across 40 repositories. Its information security branch requires that Claude Code's built-in web search and web fetch tools be unavailable in every session on agency machines, that neither a repository's maintainers nor an individual engineer can remove that restriction, and that it be in force on the first day of rollout without a change to each of the 40 repositories. What should the architect recommend?
- ACommit a deny rule for web tools to each repository's shared project settings and require code review on any change to it
- BAdd an instruction to every repository's CLAUDE.md telling Claude Code that use of the web search and fetch tools is prohibited
- CAllow the web tools, log every fetched address to a central store, and have the security branch review that log each week
- DDeploy a centrally managed policy to agency machines that denies the web tools and takes precedence over project and user settings Correct
Why A is wrong: This is tempting because committed project settings are shared and reviewable, which is the right home for most team policy. It fails two stated constraints: it needs a change in all 40 repositories before rollout, and a repository's maintainers can approve a later commit that removes the rule.
Why B is wrong: Shared project instructions do reach every session, which makes this look like a team-wide control. An instruction is guidance to the model rather than an enforced permission, so it is a weak sole control for a security requirement, and it still needs edits to all 40 repositories that maintainers could later revert.
Why C is wrong: Central logging gives the security branch visibility, which feels like governance. It is a compensating control after the fact: the requirement is that the tools be unavailable, and a weekly review only detects use that has already happened.
Why D is correct: An administrator-managed policy sits above project and user settings in Claude Code's precedence order, so no repository commit or personal setting can loosen it. Because it is deployed to machines rather than to repositories, it applies to all 40 repositories from day one without touching any of them.