23. Governance, Deployment and Observability (Tiers of Enforceability)

In Episode 23 of Beyond Prompting, author Sho Shimoda addresses how to govern, deploy, and observe Claude Code across an enterprise organization. When a security review asks what stops an employee or agent from performing unauthorized actions, answering effectively requires distinguishing hard boundaries from simple guidance. In this episode, we break down:

• The Three Tiers of Enforceability: Categorizing controls into Top Tier (OS/MDM-enforced boundaries that hold against an uncooperative user), Middle Tier (client-side controls enforced while the client cooperates, such as permission rules), and Bottom Tier (guidance and prompt-level instructions like CLAUDE.md).
• What Managed Settings Enforce: Leveraging managed-settings.json deployed via MDM to lock down sandbox paths, restrict API domains, set mandatory deny rules, and restrict connected MCP servers and plugin marketplaces.
• Observability & Telemetry: Streaming operational metrics over OpenTelemetry—tracking prompts, tool calls, file access, skills, and approvals—to create a complete audit log before security incidents occur.
• Deployment Options & Zero Data Retention: Comparing direct API usage against cloud provider gateways (AWS Bedrock, Google Cloud, Microsoft Foundry), understanding feature availability tradeoffs, and navigating Zero Data Retention (ZDR) policies.
• A Rollout Strategy That Survives Security Review: Establishing a five-step deployment sequence—setting enforced OS controls first, enabling observability before user adoption, refining client permissions, and writing guidance last.

(Note for listeners: This episode covers Chapter 23 of Sho Shimoda's book RUNNING CLAUDE: The Operator’s Guide to Chat, Cowork and Claude Code, available on Amazon as the successor book to Master Claude: Chat, Cowork and Code).