Quick Reference: Domain 7 — Developer Productivity & Operational Enablement

The domain's highest-value idea, and the substitution the exam plants. Written instructions are context: influential, right for conventions and architectural decisions, not a boundary. Permission rules and lifecycle hooks are enforced by the client, whatever the model decides. The documentation says so four times:

• Memory doc: "Claude treats them as context, not enforced configuration. To block an action regardless of what Claude decides, use a PreToolUse hook instead."
• Memory doc, on organisation-wide deployment: "Settings rules are enforced by the client regardless of what Claude decides to do. CLAUDE.md instructions shape Claude's behavior but are not a hard enforcement layer."
• Permissions doc: "Permission rules are enforced by Claude Code, not by the model. Instructions in your prompt or CLAUDE.md shape what Claude tries to do, but they don't change what Claude Code allows."
• Configuration-debugging doc: "Use CLAUDE.md for 'we do it this way here.' Use permissions or hooks for security boundaries and anything that must never happen, where you need a guarantee instead of guidance."

As of mid-2026 — re-verify before quoting. The instrument names below are product surfaces and move with the product; the guidance-versus-enforcement judgement above them does not.

Keyed answer and distractor name the same rule. Only one names a mechanism.

Learn the model; the paths are lookup. Each layer exists because of who must not override it: organisation-managed for policy nobody may switch off, project-committed for the standard inherited on clone, personal for preference, local-uncommitted for machine values that never enter shared history.

As of mid-2026 — re-verify before quoting. Settings live at ~/.claude/settings.json (user), .claude/settings.json (project, committed), .claude/settings.local.json (local, gitignored), and managed policy delivered server-side or at /Library/Application Support/ClaudeCode/, /etc/claude-code/ or C:\Program Files\ClaudeCode\. Precedence, verbatim: managed (highest, cannot be overridden by anything) → command-line arguments → local → project → user (lowest).

Command-line arguments sit above a committed team standard and below managed policy: a control the organisation depends on belongs at the top and nowhere else. The exam's layer mismatches follow from that ordering.

As of mid-2026 — re-verify before quoting. Three permission keys: allow, ask, deny, evaluated "in order: deny, then ask, then allow". additionalDirectories extends the file-access boundary, defaultMode the starting permission mode. Managed-only lock keys include allowManagedPermissionRulesOnly, allowManagedHooksOnly, allowManagedMcpServersOnly and strictPluginOnlyCustomization.

The durable property is that restrictive rules compose rather than compete, which makes the managed layer a floor and not a default:

• Settings doc: "Permission rules behave differently because they merge across scopes rather than override."
• Permissions doc: "If a tool is denied at any level, no other level can allow it." A user-level denial blocks a project-level permission just as the reverse does.
• Administrator guide: array settings "merge entries from all sources, so developers can extend managed lists but not remove from them".

The planted option assumes a permission granted in one place widens what another forbids. It never does.

As of mid-2026 — re-verify before quoting. Instruction-file scopes mirror the settings scopes: managed policy CLAUDE.md at the managed paths (cannot be excluded by individual settings), user at ~/.claude/CLAUDE.md, project at ./CLAUDE.md or ./.claude/CLAUDE.md, local at ./CLAUDE.local.md. A claudeMd key in managed settings carries the same content inline; claudeMdExcludes skips ancestor files in a monorepo. Path-scoped rules live in .claude/rules/*.md with a YAML paths field taking glob patterns, and personal rules at ~/.claude/rules/.

Root and ancestor instruction files load in full at launch, so they are paid for on every request whether relevant or not. Path-scoped rules and instruction files in subdirectories are the exception: they load only when Claude touches matching files, which is what makes scoping worth doing:

• Keep them short. The docs target under 200 lines per instruction file, because "Longer files consume more context and reduce adherence".
• Keep them consistent: "if two rules contradict each other, Claude may pick one arbitrarily".
• Scope narrow instructions to the code they govern rather than loading everything for everyone.
• A section that grows "into a procedure rather than a fact" becomes a packaged workflow.

The durable point is the unit: a procedure becomes a shared artefact, a recurring specialist task a defined role with restricted tools, a recurring context need shared project context.

As of mid-2026 — re-verify before quoting.

Skill frontmatter includes name, description, allowed-tools and disable-model-invocation; subagent frontmatter includes name, description, tools (an allowlist), disallowedTools (a denylist) and model. Plugins bundle skills, hooks, subagents and tool connections into one installable unit. A skill's body "loads only when it's used, so long reference material costs almost nothing until you need it", which is why packaging beats pasting.

As of mid-2026 — re-verify before quoting. Hooks are configured under a hooks key inside a settings file, not a standalone file of their own for project or user configuration. The reference lists roughly thirty events, including SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, PermissionRequest, PermissionDenied, Stop, SubagentStart, SubagentStop, InstructionsLoaded, ConfigChange, PreCompact, PostCompact and SessionEnd.

Memorise what the mechanism buys, not the list. Hooks run at fixed points in the lifecycle, "which gives you deterministic control: certain actions always happen rather than relying on the LLM to choose to run them". So a check that must run before a turn can end is a hook, not a request in a prompt, and it inherits the scope of the settings file holding it, and merges with rather than overriding hooks from other scopes.

Nothing secret goes into a shared layer: anything committed is visible to everyone with repository access and stays in history after deletion. Deleting it does not un-distribute it; rotating it does. Machine-specific values belong in the local uncommitted layer.

Better still, automation needing authenticated access should not hold the credential at all: Anthropic's secure-deployment guidance runs a proxy outside the agent's boundary that injects credentials into outgoing requests, so "the agent never sees the actual credentials", the proxy enforces an endpoint allowlist, and every request is logged in one place. The same page names what leaks when a workspace is mounted carelessly — environment files, git credentials, cloud credential files, registry tokens, private keys — and states the principle: "The same principles that apply to running any semi-trusted code apply here: isolation, least privilege, and defense in depth."

As of mid-2026 — re-verify before quoting. These answer "what actually loaded", the first question in both configuration debugging and incident response.

The reasoning transfers to any stack. When something configured is not taking effect, "the cause is usually that the file didn't load, it loaded from a different location than you expected, or another file overrode it" — three hypotheses, each answered by reading state.

Outcome measures are properties of the work and each has a before: cycle time from ticket to merged change, defect escape rate, review latency, new-joiner ramp-up, incident time-to-resolution. Name the measure and its baseline before the quarter starts; a baseline reconstructed afterwards is an argument, not evidence. A same-period comparison shows whether the numbers moved, not why.

As of mid-2026 — re-verify before quoting. The analytics dashboard reports PRs with CC, Lines of code with CC, PRs with Claude Code (%), Suggestion accept rate and Lines of code accepted, plus daily active users and sessions. Attribution uses a window running from 21 days before to 2 days after the PR merge date and excludes lock files, generated code and build directories, which the docs call deliberately conservative and an underestimate.

That is a usage instrument beside an outcome instrument, as the docs position it: use it "alongside DORA metrics, sprint velocity, or other engineering KPIs to understand changes from adopting Claude Code". An accept rate is the planted distractor because it is the number teams actually have.

As of mid-2026 — re-verify before quoting. The quoted lines and the gating ladder below are documentation wording; the sorting question itself is durable.

When a stem describes a task, ask what checks its output cheaply. That one question sorts the work.

The best-practices page opens on it: "Give Claude a check it can run: tests, a build, a screenshot to compare", because without one "'looks done' is the only signal available, and you become the verification loop", and closes on it: "If you can't verify it, don't ship it."

The docs grade how hard a check gates the work: requested in the prompt, then a session-level goal condition re-evaluated every turn, then a hook blocking the turn from ending until it passes. The last is enforcement rather than instruction — 7.1 reappearing inside a workflow.

Whatever produced a change is its worst available reviewer: it still holds the assumptions it wrote the change under, and confirms its own reasoning back fluently. The fix is structural — "A fresh context improves code review since Claude won't be biased toward code it just wrote", because such a reviewer sees the diff and the criteria, not the reasoning that produced the change.

Humans keep merge authority: the managed review posts findings that "don't approve or block your PR", and its check run "always completes with a neutral conclusion so it never blocks merging". The reviewer's own failure mode is named too: "A reviewer prompted to find gaps will usually report some, even when the work is sound." Scope it to correctness and stated requirements, not taste.

As of mid-2026 — re-verify before quoting. The bundled /code-review skill runs in a background subagent with its own context window and takes --fix and --comment. The managed pull-request Code Review service is in research preview on Team and Enterprise plans, posts findings at Important / Nit / Pre-existing severities, averages roughly twenty minutes and 15 to 25 US dollars per review, and reads a repository REVIEW.md.

Autonomy tracks how cheaply an action can be undone, not how much the team trusts the tooling. Bound what automation may execute, gate irreversible actions behind an approval, protect the branches that matter, and let continuous integration be the gate no confident narration talks past. Standing broad credentials granted because scoping slows people down remove the friction by removing the control.

As of mid-2026 — re-verify before quoting. The controls that shape an unattended run: --allowedTools and --disallowedTools; --permission-mode, with values default, acceptEdits, plan, auto, dontAsk and bypassPermissions; --settings and --setting-sources; -p or --print for non-interactive runs, with --max-turns and --max-budget-usd as length and spend ceilings; and --safe-mode to start with all customisations disabled.

The docs give the reason: an explicit tool restriction "restricts what Claude can do, which matters when you're running unattended". Note which enforce and which merely budget: a turn cap bounds runaway loops, the permission rules do the preventing.

The most reliably keyed answer in the domain: read what actually happened first — inputs, retrieved context, tool calls and their results, outputs, and the versions in play. A fix applied before the failure is understood usually changes something, occasionally fixes something, and always destroys the evidence.

Containment answers a different question from diagnosis, and blast radius decides which comes first:

Containment is not a diagnosis: a reverted system is quiet, not understood. Blanket containment also costs attribution, since changes reverted together teach nothing about which was responsible.

Most incidents are caused by something that changed, so the fastest narrowing question is what changed and when the symptom started. Version and timestamp every stream: prompt and instruction versions, model versions, corpus refreshes, configuration changes, dependency and connector updates. Correlating onset against that timeline eliminates most of the search space without touching the system. When two changes land in the same window, test them one at a time — Domain 4's one-variable rule in an incident, and the documented isolation technique in miniature: remove variables until the behaviour changes, then reintroduce them one by one.

As of mid-2026 — re-verify before quoting. claude --safe-mode starts with all customisations disabled while managed policy still applies; pointing the configuration-directory environment variable at an empty directory bypasses user configuration entirely. Session-level undo has a floor: /rewind, or a double Escape, restores conversation, code, or both, snapshots are kept for the 100 most recent checkpoints and deleted by default about 30 days after the session last saved one; files changed by Bash commands, most subagent edits and external changes are not tracked, and symlinked or hard-linked files are skipped on restore. The docs describe checkpoints as "designed for quick, session-level recovery" and leave "permanent version history and collaboration" to version control such as Git.

The team's ability to investigate is a deployment decision made in advance. Telemetry export is configured centrally through managed settings for that reason: "Environment variables defined in the managed settings file have high precedence and can't be overridden by users."

As of mid-2026 — re-verify before quoting. Telemetry is enabled with CLAUDE_CODE_ENABLE_TELEMETRY=1.

• Metrics: claude_code.session.count, claude_code.lines_of_code.count, claude_code.pull_request.count, claude_code.commit.count, claude_code.cost.usage, claude_code.token.usage, claude_code.code_edit_tool.decision, claude_code.active_time.total.
• Events: claude_code.user_prompt, claude_code.assistant_response, claude_code.tool_result, claude_code.api_request, claude_code.api_error, claude_code.tool_decision, claude_code.permission_mode_changed, claude_code.mcp_server_connection.
• Correlation: events carry a prompt identifier, so you can "trace all activity triggered by a single prompt"; tool results carry tool_use_id, tool_name, success, duration_ms and error_type.

Items test the shape, not the strings: correlation is what lets an agent reconstruct a timeline at volume.

An agent is a strong investigator and a poor oracle. It reads traces at volume, reconstructs a timeline, correlates a symptom against a deployment, reproduces a case and proposes hypotheses fast. Its account of its own behaviour is a hypothesis: generated from the same context that produced the behaviour, with no privileged access to the cause, persuasive because it is fluent. A human confirms it against the trace, and because one clean re-run clears nothing and one failing run proves nothing, confirmation means a pattern across collected cases.

The closing checklist, and the near-passer trap is stopping after the first line:

• A fix at the failing layer, verified against the case that actually failed.
• A regression case added to the suite Domain 4 owns.
• A runbook update, written while the gap is fresh.
• Any access gap the incident exposed either closed or recorded.

An investigation plan assuming access the on-call engineer does not have is not a plan, and an incident closed with no artefact is paid for twice.