Notifications
Clear all
Topic starter
19/08/2026 3:52 pm
TL;DR: Claude Code users get only about 40% of the tool’s value until they treat CLAUDE.md, context management, forks, hooks, and MCP as governance controls rather than productivity tricks, according to Obot. The deeper lesson is that agentic coding becomes a security and operating-model problem the moment teams need isolation, scoped permissions, and auditability.
NHIMG editorial — based on content published by Obot: From ‘It Works’ to ‘It Scales’
Questions worth separating out
Q: How should teams govern AI-assisted development workflows that use coding agents?
A: Treat them as identity-governed execution paths, not just productivity tools.
Q: Why do long agent sessions create security and quality risks?
A: Long sessions accumulate stale assumptions, repeated corrections, and contradictory state, which degrades output quality and makes bad decisions harder to unwind.
Q: What breaks when agents share memory and context too broadly?
A: When agents share memory too broadly, one incorrect or malicious write can shape multiple downstream decisions.
Practitioner guidance
- Define CLAUDE.md as an enforceable policy layer Write the file as standing orders for architecture, testing, and prohibited actions, then review it like any other control document.
- Reset long sessions before reasoning drifts Use compact and undo intentionally when an agent starts repeating itself, contradicting earlier decisions, or carrying stale context into new work.
- Separate parallel work into isolated branches Use forked branches for any task where one agent’s reasoning could contaminate another’s, and pair that with absolute paths for file references across workspaces.
What's in the full article
Obot's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step examples of CLAUDE.md structures for different project types and governance styles
- Practical walkthroughs of /compact, /btw, /fork, and hook usage in live agent workflows
- Debug logging and state-manager behaviour that help teams understand how sessions change over time
- Local MCP server setup patterns and the mechanisms behind structured elicitation in agent workflows
👉 Read Obot's guide to scaling Claude Code with context, hooks, and MCP →
Claude Code governance at scale: what teams are missing?
Explore further
19/08/2026 4:29 pm
Agentic coding is turning developer tooling into a non-human identity governance problem. Once Claude Code can read policy files, call tools, and persist session state, the control question is no longer only how well it writes code. It is what boundaries define its authority, what state it carries forward, and who can override its actions. That is exactly the kind of governance question identity teams already face with service accounts and automation. The practitioner conclusion is that agentic development needs explicit ownership, scoped permissions, and auditable control points.
A question worth separating out:
Q: Who should own MCP access governance in an enterprise?
A: Ownership should sit with identity and security teams, not only application developers, because MCP connects user intent to privileged execution. The governing team needs authority over policy design, review cadence, and audit evidence. That keeps MCP aligned with enterprise authorization standards rather than ad hoc server behaviour.
👉 Read our full editorial: Claude Code tips expose the governance gap in agentic coding
