Podcasts · Master Claude Chat, Cowork, Code
23. Governance, Deployment and Observability (Tiers of Enforceability)
· 1 h 00 min
Episode 23. Governance, Deployment and Observability (Tiers of Enforceability)
In Episode 23 of Beyond Prompting, author Sho Shimoda addresses how to govern, deploy, and observe Claude Code across an enterprise organization. When a security review asks what stops an employee or agent from performing unauthorized actions, answering effectively requires distinguishing hard boundaries from simple guidance. In this episode, we break down:
• The Three Tiers of Enforceability: Categorizing controls into Top Tier (OS/MDM-enforced boundaries that hold against an uncooperative user), Middle Tier (client-side controls enforced while the client cooperates, such as permission rules), and Bottom Tier (guidance and prompt-level instructions like CLAUDE.md).
• What Managed Settings Enforce: Leveraging managed-settings.json deployed via MDM to lock down sandbox paths, restrict API domains, set mandatory deny rules, and restrict connected MCP servers and plugin marketplaces.
• Observability & Telemetry: Streaming operational metrics over OpenTelemetry—tracking prompts, tool calls, file access, skills, and approvals—to create a complete audit log before security incidents occur.
• Deployment Options & Zero Data Retention: Comparing direct API usage against cloud provider gateways (AWS Bedrock, Google Cloud, Microsoft Foundry), understanding feature availability tradeoffs, and navigating Zero Data Retention (ZDR) policies.
• A Rollout Strategy That Survives Security Review: Establishing a five-step deployment sequence—setting enforced OS controls first, enabling observability before user adoption, refining client permissions, and writing guidance last.
(Note for listeners: This episode covers Chapter 23 of Sho Shimoda's book RUNNING CLAUDE: The Operator’s Guide to Chat, Cowork and Claude Code, available on Amazon as the successor book to Master Claude: Chat, Cowork and Code).
Links in the notes 1
Shows are listed from Apple Podcasts' charts and directory, and Podcast Index where it is used. Every show and episode belongs to its publisher and plays from the publisher's own feed; this site hosts none of them. Explicit shows are for adult profiles only, and children’s profiles hear only children’s shows. More about this list.