Claude Code Enterprise Environment

1. Executive Summary

Claude Code is Anthropic's AI-powered coding assistant that runs inside VS Code (and the terminal). It can read files, write code, execute shell commands, and interact with external services through a protocol called MCP (Model Context Protocol). We are already using it to build the SGA platform and have proven its value across architecture, code generation, data analysis, and reporting.

This document evaluates how to deploy Claude Code across a team in a secure, governed enterprise environment. The core question: do we run on local machines, move to hosted remote servers, or use a hybrid approach?

For Power BI integration, we should continue the current bridge API pattern but move it behind our VPN with proper authentication — this is safer than giving Claude Code direct access to the Power BI service.

2. What Is Claude Code

Claude Code is not a simple autocomplete tool like GitHub Copilot. It is an agentic coding environment — meaning it can autonomously execute multi-step tasks: read files, write code, run shell commands, search the web, and interact with external APIs. It operates inside VS Code through an official extension or directly in the terminal.

Key Capabilities

• File I/O: Read, create, and edit any file in the project directory
• Shell execution: Run bash commands (build, test, deploy, git)
• Web access: Fetch URLs, search the web for documentation
• MCP integrations: Connect to external services (databases, APIs, vaults) through standardized protocol servers
• Agent orchestration: Spawn sub-agents to parallelize complex tasks
• Persistent memory: Learns project conventions, user preferences, and decisions across sessions

How It Works Architecturally

3. Architecture Options

There are four viable architectures for running Claude Code in an enterprise. Each has trade-offs around security, cost, complexity, and developer experience.

Option A: Hardened Local Machines Recommended

Each developer runs Claude Code on their own laptop/desktop with VS Code. Security is enforced through Anthropic's managed settings, OS-level sandboxing, dev containers, and organizational policies.

Option B: Remote Dev Servers (VS Code Remote SSH) Viable

Each developer gets a dedicated cloud VM (AWS EC2, Azure Dev Box, or similar). They connect via VS Code Remote SSH. Claude Code runs on the remote server, files stay on the server.

Option C: Dev Containers (Cloud or Local) Viable

Each developer runs Claude Code inside a Docker dev container — either locally or on a cloud host like GitHub Codespaces. The container provides OS-level isolation with a firewall that restricts network access to whitelisted domains only.

Option D: Hybrid (Local + Scheduled Remote) Future

Developers work locally during the day. A shared remote server runs scheduled Claude Code tasks overnight (automated code reviews, report generation, monitoring). Anthropic's "Remote Control" and "Dispatch" features (released Feb 2026) enable this.

4. Recommended Architecture

Why Not Remote Servers?

The instinct to centralize on remote servers comes from traditional security thinking: "keep the code off laptops." But with Claude Code, this reasoning has a flaw:

• The API calls go to Anthropic regardless. Whether Claude Code runs on a laptop or a server, the conversation context (including code being analyzed) is sent to Anthropic's cloud over HTTPS. Moving to a remote server does not eliminate this data flow — it just adds infrastructure cost.
• Anthropic's Enterprise plan already provides zero-data-retention. Your code is not stored or used for training. The data protection is contractual, not architectural.
• Local sandboxing is strong. Anthropic's OS-level sandbox (Seatbelt on macOS, bubblewrap on Linux) restricts file and network access at the kernel level. Managed settings prevent users from disabling these protections.
• Remote servers add attack surface. SSH keys, VM patching, network configuration, shared storage — each is a potential vulnerability that local machines don't have.

When Remote Makes Sense (Future)

• Unattended automation: Nightly code reviews, scheduled report generation, CI/CD integration
• Contractor access: Give contractors a locked-down cloud environment instead of VPN access
• Compliance requirements: If a future audit requires all code access from managed infrastructure
• Team scale: Above ~20 Claude Code users, centralized management becomes more efficient

Architecture Diagram — Recommended Setup

5. Security Hardening

Anthropic provides a layered security model that can be locked down for enterprise use. Here is the hardening plan, ordered from most critical to least.

5.1 Managed Settings (Non-Overridable)

These settings are pushed via MDM (Intune for Windows, Jamf for macOS) to ~/.claude/managed-settings.json. Users and project-level configs cannot override them.

{
  "permissions": {
    "deny": [
      "Bash(rm -rf *)",
      "Bash(curl * | bash)",
      "Bash(wget * | bash)",
      "Bash(git push --force *)",
      "Read(~/.ssh/*)",
      "Read(~/.aws/*)"
    ],
    "ask": [
      "Bash(git push *)",
      "Bash(npm publish *)",
      "Edit(*.env*)"
    ],
    "allow": [
      "Bash(npm run *)",
      "Bash(npm test *)",
      "Bash(git status)",
      "Bash(git diff *)",
      "Bash(git log *)",
      "Read(*)",
      "Glob(*)",
      "Grep(*)"
    ]
  },
  "allowManagedPermissionRulesOnly": true,
  "allowManagedMcpServersOnly": true,
  "permissions.disableBypassPermissionsMode": true,
  "sandbox.network.allowManagedDomainsOnly": true,
  "forceRemoteSettingsRefresh": true
}

5.2 OS-Level Sandboxing

5.3 Network Restrictions

The sandbox proxy controls outbound network access. In managed mode, only whitelisted domains are reachable:

• api.anthropic.com — Claude API (required)
• registry.npmjs.org — npm packages
• github.com, api.github.com — source control
• 142.93.182.236:3050 — Power BI bridge API (internal, VPN-only)
• Block everything else by default

5.4 Pre-Tool-Use Hooks

Hooks run before every tool invocation and can block, allow, or require approval. They are shell scripts that execute locally:

# .claude/hooks/pre-tool-use.sh
# Block any command that touches production databases
if [[ "$CLAUDE_TOOL" == "Bash" ]]; then
  if echo "$CLAUDE_TOOL_INPUT" | grep -qiE "(DROP|DELETE|TRUNCATE|ALTER).*production"; then
    echo "BLOCKED: Production database operations require manual execution"
    exit 2  # deny
  fi
fi
exit 0  # allow

5.5 Dev Container Isolation (Optional Layer)

For maximum isolation, developers can run Claude Code inside Anthropic's reference dev container. This adds:

• Docker-level filesystem isolation (code cannot escape the container)
• iptables firewall with default-deny outbound policy
• Reproducible environments (no "works on my machine" issues)
• Pre-configured Node.js 20, npm, git, and dev tools

6. Power BI Integration

SGA has 96% Power BI adoption. Our current integration uses a bridge API — a lightweight Node.js service that accepts DAX queries and returns results from the Power BI service. This is the right pattern; here's how to harden it for enterprise.

Current Architecture

Hardening Recommendations

Recommended: Named Query Pattern

Instead of allowing Claude Code to compose arbitrary DAX, the bridge should expose named queries — pre-approved business questions mapped to parameterized DAX:

// Instead of raw DAX:
POST /query { "dax": "EVALUATE SUMMARIZE(..." }  // DANGEROUS

// Use named queries:
POST /query/morning-brief { "practice_id": "P123" }  // SAFE
POST /query/production-ytd { "region": "Southeast" }  // SAFE
POST /query/underperformers { "threshold": 0.85 }     // SAFE

This eliminates the risk of Claude Code composing a DAX query that returns sensitive data outside the user's scope. We already have this pattern started in the powerbi-queries skill.

7. Data Flow & Privacy

What Data Goes Where

Anthropic's Enterprise Data Commitments

• No model training: Enterprise inputs/outputs are never used to train Claude models (contractual guarantee)
• Zero Data Retention (ZDR): Configurable — no inputs/outputs stored after response is delivered
• SOC 2 Type II + ISO 27001: Independently audited security controls
• ISO/IEC 42001:2023: AI-specific governance standard
• Encryption: TLS 1.3 in transit, AES-256 at rest (if retained), BYOK coming H1 2026

8. Identity & Governance

SSO Integration

Anthropic Enterprise supports SAML 2.0 and OIDC. SGA should integrate with Microsoft Entra ID (our existing identity provider) for:

• Single sign-on — developers authenticate with their SGA credentials
• SCIM provisioning — auto-create/deactivate accounts based on Entra ID group membership
• Conditional access — enforce MFA, block untrusted devices, geo-restrict
• Domain verification — prove ownership of sgadental.com via DNS TXT record

Role-Based Access

Audit Logging

Anthropic Enterprise provides 180-day audit logs covering:

• Authentication events (who logged in, when, from where)
• API usage (tokens consumed, model used, session duration)
• Permission denials (what was blocked and why)
• Export: JSON/CSV download or SIEM push (Splunk, Datadog, Elastic)

Additionally, our own PreToolUse hooks can log every tool invocation locally for compliance review.

9. MCP Server Security

MCP (Model Context Protocol) servers extend Claude Code with external capabilities. They are powerful but represent a significant attack surface because they are executable code that Claude Code can invoke.

Current MCP Servers in Use

Enterprise MCP Policy

1. Allowlist only: Set allowManagedMcpServersOnly: true — users cannot add their own MCP servers
2. Code review: Every new MCP server must be reviewed by IT before being added to the allowlist
3. Source control: Only MCP servers from our GitHub org or trusted vendors (Anthropic, verified npm packages)
4. Network isolation: MCP servers that access external APIs must go through the VPN
5. No credential exposure: MCP servers should use service principals / environment variables, never hardcoded secrets

10. Cost Model

Anthropic Enterprise Pricing

Infrastructure Costs by Architecture

Total Annual Cost Comparison (5 Users)

11. Rollout Plan

Phase 1: Foundation (Weeks 1-2)

• Purchase Anthropic Enterprise plan (self-serve, 5 seats)
• Configure SSO with Microsoft Entra ID (SAML 2.0)
• Verify sgadental.com domain
• Draft and deploy managed settings via Intune
• Set up audit log export to existing SIEM

Phase 2: Hardening (Weeks 3-4)

• Install WSL2 + bubblewrap on all developer machines (for sandbox)
• Configure MCP server allowlist (obsidian-mcp, discord only initially)
• Move Power BI bridge behind VPN with HTTPS + token rotation
• Implement named query pattern for Power BI (block raw DAX)
• Deploy PreToolUse hooks for compliance logging
• Create CLAUDE.md governance file for org-wide standards

Phase 3: Team Onboarding (Weeks 5-8)

• Onboard 3-5 developers with guided setup
• Provide dev container configs for isolated project work
• Run security awareness session (prompt injection risks, data handling)
• Monitor audit logs for anomalies — tune permission rules based on actual usage
• Document approved workflows and escalation procedures

Phase 4: Scale & Automate (Ongoing)

• Add automation server for scheduled tasks (morning briefs, nightly code reviews)
• Expand MCP server allowlist as new integrations are vetted
• Evaluate moving to sales-assisted Enterprise plan as seats exceed 50
• Quarterly security review of managed settings, hooks, and MCP servers
• Assess BYOK encryption when available (H1 2026)

12. Risk Matrix

Appendix: Decision Summary for Ron