A common take from security folks at conferences is that 'security lives in CLAUDE.md' Unfortunately, that has nothing to do with how Claude Code actually enforces policy.

If you're rolling out Claude Code across a company, CLAUDE.md is not your security layer. It's behavioral guidance — Claude reads it and tries to follow it. The thing that...