Claude Code best practices for a team: what to write down and what to enforce

Last updated: November 11, 2026

TL;DR

The best practice for running Claude Code on a team is to sort every rule into two piles: guidance Claude may weigh, and rules Claude Code enforces. Guidance goes in a short CLAUDE.md and in skills. Rules that can't have exceptions go in hooks, deny rules or managed settings, at a scope that matches who they apply to.

• 📝 Write down what Claude can't see. Test commands, misleading code and decisions that aren't in the repo. Keep CLAUDE.md under 200 lines.
• 🔒 Enforce the few rules with no exceptions. Anthropic's best practices guide names hooks, deny rules and managed settings for this.
• 🎯 Match the scope to the people. Commit .claude/settings.json for the repo, and use managed settings for anything a developer must not be able to change.
• ✅ Give Claude a check it can run. A test command beats a request to be careful.
• 📊 Measure a pilot first. Anthropic's average is about $13 per developer per active day across enterprise deployments.

On Anthropic's published range of $150 to $250 per developer per month, a 10-person pilot runs about $1,500 to $2,500 a month. That's the number to confirm with your own team before you widen the rollout.

Claude Code best practices for a team, in one table

A rule in the wrong pile fails quietly: a "never" in CLAUDE.md holds until the one time it doesn't. Anthropic's guide splits every instruction into the kind Claude decides on and the kind the harness has to execute. Here's that split for the five things a team usually cares about:

Both columns are useful. Anthropic's advice is that you want Claude to decide most of the time, because it's reading the actual code. The right-hand column is for the handful of things that must always or never happen.

Write down what Claude can't see

A team's CLAUDE.md should hold only what Claude couldn't work out from the code, because Claude Code loads the file into every session and every line takes some attention on every task. Anthropic's guide lists four things that earn a place:

1. How to confirm work in this repo: the exact test, typecheck and lint commands.
2. Places where the code misleads, such as an old pattern new code must not copy.
3. Decisions that aren't in the repo, such as how deploys work.
4. Anything you've had to correct twice.

Anthropic's memory docs say to target under 200 lines per file, since longer files use more context and reduce adherence. Two habits are now on Anthropic's list of advice to drop: describing your architecture and file layout in CLAUDE.md, and adding IMPORTANT or all caps to lines Claude keeps missing. Our CLAUDE.md context diet covers how to cut a file that has grown too long.

Three other places hold what doesn't belong in that file:

• CLAUDE.local.md holds one person's preferences. Add it to .gitignore so it stays out of the repo.
• .claude/rules/ holds rules for one part of the codebase. A paths: filter loads them only when Claude works there.
• Skills hold team procedures such as a release or an incident runbook. Claude sees only the name and description until a task calls for the full file. For anything with side effects, set disable-model-invocation: true so it runs only when someone types the command.

Enforce the rules that can't have exceptions

If something has to happen every time, make it a hook, a deny rule or a managed setting. Claude follows a line in CLAUDE.md almost every time, and the rest of this section is for the rules where "almost" isn't good enough.

Deny rules hold in every permission mode, including auto and bypass. They match tool calls rather than intent, though. A Read deny rule catches cat .env, and it won't catch a script that opens the file. Anthropic's guide says to use both the permission rules and the sandbox for anything security-related.

Our Claude Code hooks guide walks through the hooks in that table, including the default that's easiest to miss: a hook that crashes lets the action through unless you set "onFailure": "block".

Keep this set small. Anthropic's guide warns that every hook and deny rule will occasionally fire when it shouldn't, and that someone has to maintain each one. Its test for too many is blunt: at forty, most are probably preferences Claude could have weighed itself.

Put each rule at the right scope

Where a rule lives decides who it applies to, so pick the file by asking who must follow the rule and who is allowed to change it.

Precedence runs from managed settings at the top, through the command line, project local and shared project, down to user. Permission rules add a stricter guarantee: if a tool is denied at any level, no other level can allow it. Managed settings can't be overridden by a personal settings file, which is why Anthropic calls them the only place for a security team's policy.

A committed .claude/settings.json has one timing detail worth telling your team. Its deny rules apply right away, while its allow rules wait until each person accepts the trust dialog for that folder. Our Claude SSO and admin settings guide covers the organization side of a Team plan.

Give Claude a check it can run

Claude stops when the work looks done, so a team needs something that comes back pass or fail. Without one, the person reviewing the pull request becomes the test suite. The options run from Claude deciding for itself to something it can't talk its way past:

1. In the prompt. Ask Claude to run the tests and keep going until they pass. It needs no setup, and Claude decides when it's satisfied.
2. A fresh reviewer. /code-review reviews the diff in a subagent that never saw your conversation.
3. A Stop hook. It runs when Claude tries to end its turn and sends it back if your script exits 2.
4. CI and branch protection. These sit outside Claude Code entirely, so a person still approves the merge.

Whichever you use, ask for evidence: the command Claude ran and its output. For a session nobody was watching, that output is the only record you have. The single most useful line in a team's CLAUDE.md, by Anthropic's account, is the command that runs the check.

Measure a pilot before you widen it

Start with a small group, set a baseline, then expand, which is also Anthropic's advice for estimating spend. Across enterprise deployments, Anthropic reports an average of about $13 per developer per active day and $150 to $250 per developer per month, with 90% of users staying below $30 per active day. Your numbers will differ with model choice, codebase size and how many sessions people run at once.

Contribution metrics aren't available for organizations with Zero Data Retention turned on, so those teams see usage metrics only. If your first question is what Claude keeps and for how long, our Claude data privacy guide covers that.

Frequently asked questions

What are the best practices for using Claude Code on a team?

Keep CLAUDE.md short and limited to what Claude can't work out from the code. Enforce rules with no exceptions through hooks, deny rules or managed settings. Commit shared settings to the repo, give Claude a test it can run, and measure a pilot before you expand.

What should go in a team's CLAUDE.md?

Put in the exact test, typecheck and lint commands, places where the code misleads, decisions that aren't in the repo, and anything you've had to correct twice. Leave out architecture and file layout, because Claude reads the repo itself. Anthropic's docs say to stay under 200 lines.

Should team rules go in CLAUDE.md or settings.json?

Use CLAUDE.md for guidance Claude can weigh, and .claude/settings.json for rules that must hold every time, such as hooks and deny rules. If you keep adding emphasis to a CLAUDE.md line and Claude still misses it, Anthropic says that line belongs in a hook.

Can a developer override the team's Claude Code settings?

Not managed settings. No personal settings file can override them. For permission rules, a tool denied at any level can't be allowed at another. Settings in a committed .claude/settings.json sit below a developer's local project file for ordinary keys, so use managed settings for real policy.

How much does Claude Code cost per developer?

Across enterprise deployments, Anthropic reports about $13 per developer per active day and $150 to $250 per developer per month, with 90% of users below $30 per active day. Costs vary with model choice, codebase size and how many sessions people run.

How do we track Claude Code usage across a team?

Team and Enterprise Admins and Owners can open the analytics dashboard at claude.ai/analytics/claude-code for active users, sessions and accept rate. For per-person token counts and cost estimates, set up OpenTelemetry export or export the spend report.

Is auto mode enough to keep a team safe?

No. Auto mode is a classifier judging each action, so it can be wrong, and Anthropic says your "never" rules belong in deny rules or hooks. Deny rules hold in every permission mode, including auto and bypass.

How many hooks and deny rules should a team have?

As few as cover the rules with no exceptions. Each one will occasionally fire when it shouldn't, and someone has to maintain it. Anthropic's guide says that if you reach forty, most are probably preferences Claude could have weighed on its own.

Get Claude Code set up properly for your team

We set up Claude Team for small businesses: the seat plan, the security settings, shared Projects and skills written from your actual processes, and managed Claude Code settings for teams with developers. If you'd rather have it done once and done right, see how our Claude Team setup works or book a 30-minute call.