A shared Claude conversation returns HTTP 200 whether or not you can read it, and the page carries six characters of visible text. Team and Enterprise chats are organization-only by design, attached files never travel with the snapshot, and the one programmatic route is a Compliance API that has no idea what a share link is.
Claude Code loads your CLAUDE.md into every subagent except two. Explore and Plan skip it by design, and no setting changes that. So the agents you fan out most widely are the ones that never see your rules. ETH Zurich measured what the file costs on the occasions it does load.
A git worktree isolates your working directory and your index. It does not isolate the stash stack, which is shared by every checkout in the repository. Here is what I measured on git 2.50.1, why MERGE_AUTOSTASH escapes the problem through an accident of spelling, and how one defensive stash can make a worktree look safe to delete.
Merge queues, merge trains, and speculative merging all rest on one assumption nobody states: that a per-branch green tick means the code works. Our own CI runs no unit tests at all, and master went red twice in two days from pull requests that were each green on their own. Here is what to build before you buy the queue.
Giving everyone Claude inside an isolated VM, no sensitive data allowed, feels like the safe way to start. It is a fine way to start. The trouble is what happens when you leave people there: the leak it was built to stop walks out by copy-paste anyway, the friction recruits the shadow AI you were trying to prevent, and the value never compounds because nothing in an ephemeral box survives the session. A sandbox is a scaffold. Scaffolds come down.
Two objections kill most regulated-finance AI conversations before they start. The first, that Anthropic does not permit Claude for regulated work, is false: Claude for Financial Services exists, banks run it, and the usage policy names finance high-risk, not forbidden. The second is real and almost nobody states it plainly: first-party Claude Enterprise has no EU data residency at all. There is no "eu" inference region and workspace storage is US-only. If you are FCA-regulated, that is the fact to design around, and the only EU route runs through a hyperscaler.
Treat every MCP server as untrusted code that runs with the access your agent has, because that is what it is. Anthropic docs say the directory lists connectors but does not security-audit them. A registry of approved servers with nothing enforcing it is a memo. The control that binds is a managed allowlist matched by URL or command, never by name.
Before you hand Claude Code to hundreds of people you add deny rules for .env and credentials and feel locked down. You are not. Those rules govern Claude own tools, not a Python one-liner that opens the same file, and the control that actually holds, the OS sandbox, reads your whole machine by default and fails open when it cannot start. The baseline worth setting is real. Its dangerous gaps are the defaults you never changed.
You want a Claude job to run every few hours on your Mac, not in the cloud. A cloud routine cannot do it, because it never touches your machine. Here are the local options that can, why launchd beats cron for this, and a working LaunchAgent that pulls every one of my repos on a schedule.
Claude Code /loop reruns a prompt on an interval inside your session. It is perfect for babysitting a deploy or a test run, and wrong for anything that has to keep going while you are away. It also exposes a durable flag that, on version 2.1.185, quietly writes nothing to disk. Here is how to use it well.
Your CISO trusts the control posture Microsoft gives Copilot. To get Claude to the same bar, do not reach for tenant restrictions: that header only fires on your network, so it is theater the moment a laptop goes off-VPN. The control that holds lives at identity. Enforce SSO, then claim your domain, and know that the claim is a one-way door.
An accessibility overlay is one line of JavaScript that promises ADA compliance while you do nothing. The FTC fined accessiBe a million dollars over that promise. Here is why a widget cannot fix a problem that lives in your code, and how real AI auditing does the reverse by finding the broken line so a person can change it.
Automated accessibility tools catch maybe a third of WCAG problems. I pointed Claude Code at Tallyfy, my own product, and let it run a real WCAG 2.2 audit with a live screen reader across four codebases. It found bugs that axe-core cannot see, and it showed clearly where the work still needs a person.
The hard part of a big AI job is not the work. It is making the agent run for many sessions without drifting or claiming it is done when it is not. I used an accessibility audit across four codebases as the test. The setup that kept Claude Code on track was a git ledger, atomic parallel claims, and two verification passes.
Locked-down shops reach for a proxy exception to make Claude Code connect. Wrong move, and it fails anyway. Claude Code does not pin certificates, so it works through full TLS inspection once you teach it to trust your corporate root CA. The fix is a couple of environment variables and an egress allowlist, not a hole in the proxy.
Every enterprise AI maturity model starts a rung above where most companies stand and skips the one that holds the rest up: getting the tool safely into people hands. Your team already has Claude. If IT cannot produce the tenant policy, the egress allowlist, the tool allowlist, and the audit log, you are at phase zero, whatever the deck says.
A VPAT is the report that states how accessible your product is, measured against WCAG. People ask what it costs and price the document, but the document is the cheap part. The real cost is re-auditing every release, and that is the number an AI agent actually moves. Here is the ADA, WCAG, Section 508 and EN 301 549 stack underneath it.
Axe-core catches about a third of WCAG failures and skips anything that needs judgment. Here are the thirteen criteria a scanner cannot decide, how an AI agent drives a real VoiceOver session to cover them, and the save button that passed every automated check and was silent to a blind user.
An AI context layer feeds every model one governed source of company truth, and DataHub and Atlan will sell you that read half today. The half that notices when a person did not get what they wanted, the re-ask nobody logged, is what turns a knowledge store into a brain.
Some advisors resist letting a company connect AI to its own systems, dressed up as too risky. The Everlaw survey found 90% of legal professionals expect AI to change billing within two years. The real driver is an AI consultant protecting the gatekeeper role.
Good-enough AI is driving commoditization from below. Stanford HAI clocked a 280-fold drop in the cost of running a GPT-3.5-level model. Once a cheaper model clears the bar for a job, the frontier model stops earning its premium for that job.
Companies build AI agents shaped like their org chart: an ERP agent, an HR agent, a finance agent. Each one is a silo with a chat box. The real payoff shows up when skills compose across functions, because data exists to tell a story or trigger an action, not to sit in one department.
Business intelligence was always the quantitative side: rows, numbers, things that fit in a column. The qualitative half, the calls and emails and tickets where the why actually lives, was invisible to it. That half is most of your data, and it is where AI adds value BI never could.
Teams building analytics AI keep starting from a blank page. Meanwhile the most validated business logic they own is sitting in the dashboards they already shipped. Those reports are years of distilled definitions and a ready-made test set. Mine them.
Everyone obsesses over whether the model reasons well. The real failure in AI over business data happens earlier, at the moment the agent decides what you meant. A confident answer to the wrong question is worse than no answer at all.
Anthropic managed agents bill $0.08 per session-hour, and everyone races to compare that to a cheap VM. The comparison misses the point. Runtime is a rounding error next to tokens, and the operations bill decides the rest. Here is where self-hosting an AI agent actually starts to pay, with the real 2026 numbers.
Every BI team has quietly run the same triage for years: is this worth a dashboard, or is it a one-off? Building a dashboard was the only durable option, so the long tail of one-time questions mostly went unasked. AI collapses the cost of the one-off, and that reshapes the whole portfolio.
Most people treat a Power BI report and its semantic model as one object. They are two files doing two jobs. When you point an AI agent at your data, the report is the cheap half and the semantic model is the part that took three years to get right.
Low-code agent builders like Copilot Studio get you to a working demo in an afternoon. That is real, and it is also the trap. The question is not whether it demos well. It is what you give up the day you need control, and whether you will need control.
The Claude Certified Architect credential sits on a free, four-course learning path: Agent Skills, the Claude API, the Model Context Protocol, and Claude Code in Action. The courses carry the value. The exam is the paperwork. What each course covers and who on your team should take it.