title: "Claude Code — For Tech Leads & Engineering Managers" description: "How to deploy Claude Code across your team: shared config, security hooks, and adoption strategy." section: "roles" readTime: "10 min"

Claude Code — For Tech Leads & Engineering Managers

You've probably heard your devs talk about Claude Code. Maybe some are already using it. This page is for you — the person responsible for making that adoption consistent, secure, and scalable across the team.

The core problem

Left to their own devices, each developer builds their own Claude Code setup. Different CLAUDE.md files, different permission configs, no shared hooks, no observability. The productivity gains are real but chaotic, and the security surface grows unchecked.

A team with a shared configuration gets more consistent quality and a smaller security surface than the same devs working with individual setups. (Treat any specific multiplier you read online as unverified. Measure it with your own analytics.)

What you get from this guide

30-minute reading path

Whitepapers are available at florian.bruniaux.com/guides

1. WP05 — Deploying with a Team (25 min)

   • CLAUDE.md and settings hierarchy (managed / user / project / local)
   • Champions program: how to identify and empower early adopters
   • GitHub Actions for automated review + security scanning
   • Adoption phases: pilot → expansion → generalization

2. Guide Ch.3.5 — Team Configuration at Scale (5 min)

   • How to version your team config in the repo
   • Shared vs personal settings

The 4 things to do this week

1. Version your CLAUDE.md in the repo

Run /init in your main repo to draft a CLAUDE.md, then edit it and commit it. Claude Code loads it for everyone on the team at the start of each session. Start with build and test commands, coding conventions, and architecture decisions. Remember that CLAUDE.md is guidance, not enforcement: Claude usually follows it but can deviate. Enforce hard rules with permissions, hooks, or managed settings (see step 3). Also commit .claude/settings.json (shared permission rules) and keep personal overrides in .claude/settings.local.json.

2. Identify one champion

One engineer who's already effective with Claude Code. Give them time to document their setup and run a 1h team session.

3. Add one security hook

The minimum: a PreToolUse hook that blocks edits to .env files and secrets/ paths. Hooks receive a JSON object on stdin (not environment variables), and exit code 2 blocks the tool call and feeds your stderr message to Claude. Takes 10 minutes to set up, covers a real threat vector.

#!/bin/bash
# .claude/hooks/block-sensitive-files.sh (requires jq)
input=$(cat)
file=$(jq -r '.tool_input.file_path // empty' <<<"$input")
 
if [[ "$file" =~ .env$ || "$file" == *secrets/* ]]; then
  echo "Blocked: sensitive file path" >&2
  exit 2
fi
exit 0

Register it in .claude/settings.json under hooks.PreToolUse with "matcher": "Edit|Write". For the same goal without a script, add permissions.deny rules such as Read(./.env). Hooks only run when the file path is passed to a file tool, so pair them with deny rules and the sandbox for Bash.

See the Hooks guide on this site and Guide Ch.7.4 — Security Hooks for more.

4. Decide what is enforced vs. advised

Admins can push managed settings (server-managed, MDM, or managed-settings.json) that users cannot override: permission rules, hooks, allowed MCP servers, and more. Use them for the non-negotiables. Use the analytics dashboard (Team and Enterprise) or OpenTelemetry to see adoption and cost.

Security posture overview

Key risks for teams:

• Prompt injection via untrusted file content, web pages, or MCP servers
• Overly permissive settings — blanket allow rules or bypassing permissions on machines with secrets
• Unvetted MCP servers, plugins, and skills — Anthropic does not security-audit MCP servers, so treat them like npm packages (supply chain risk) and restrict them with managed MCP configuration
• Missing audit trail — who did what, when (use OpenTelemetry export, analytics, and hooks)

Official reference: Claude Code security. Also see the Security guide on this site, and WP03 — Security and WP06 — Privacy (whitepapers at florian.bruniaux.com/guides).

Training your team

If you want structured onboarding rather than self-learning:

• Brown Bag Lunch, talk, or panel (1–3h, free) — intro session, live demo, or speaker slot. Done for the pleasure of it: sharing, getting challenged, building network.
• Config audit — review your current setup against security and productivity best practices.
• Team formation (1–2 days) — hands-on, your codebase, your workflows. Not something actively sought, but open to the right conversation.

→ Contact Florian Bruniaux for availability and, depending on the mission, potentially pricing

Quick links

• Full Guide — start at Ch.3.5 for team config
• Whitepapers — focused deep-dives at florian.bruniaux.com/guides
• Templates — ready-to-use hooks, agents, CLAUDE.md examples
• Security Hardening — mitigation guide
• CHANGELOG — what changed recently