How can teams tell whether a CLAUDE.md rule is actually enforceable?

Why This Matters for Security Teams

A CLAUDE.md rule only helps security if the platform can convert it into an enforceable control, not just a prompt preference. That means the rule must map to a specific action, target, condition, and approval path, with the system able to deny or constrain the action at runtime. This distinction matters because agent behaviour is goal-driven and can shift as context changes, which is exactly where text-only policy fails.

Security teams often assume a rule is real once it is documented, reviewed, or committed to source control. In practice, that is not enough. A rule like "do not modify production files" is unenforceable if the agent can still access the repo, toolchain, or deployment path that makes the change possible. The same problem appears in NHI governance when access is described in policy but not bound to workload identity, secrets, or execution context. For a broader view of how invisible identity sprawl creates this gap, see NHI Mgmt Group’s Ultimate Guide to NHIs and NIST’s NIST SP 800-53 Rev 5 Security and Privacy Controls.

NHI Mgmt Group reports that only 5.7% of organisations have full visibility into their service accounts, which is a useful warning sign here: if teams cannot see what an identity can actually do, they usually cannot tell whether a rule is enforceable either. In practice, many security teams discover this only after an agent has already taken an unexpected tool action, rather than through intentional control testing.

How It Works in Practice

The practical test is to treat the rule as enforceable only when the platform can make a hard decision at the moment of execution. Start by asking whether the agent, plugin, or runner can identify the exact tool call, file path, repository, environment, or external system the rule applies to. Then verify that the control engine can block, require approval, or narrow the action before the request completes. That is closer to NIST SP 800-53 Rev 5 Security and Privacy Controls than to a style guide.

For agentic systems, the strongest signals of enforceability are:

• The rule is tied to a runtime policy check, not just a markdown instruction.
• The system can prove which identity or workload is acting, rather than relying on a static human-style role.
• The control includes scope, such as repo, branch, directory, command class, or external API target.
• The approval path is explicit, auditable, and condition-based.
• The platform can revoke or deny the action without waiting for a later review.

This is why teams should test with realistic agent actions, including chained tool use, retries, and partial failures. A rule can look strict in prose and still be bypassed if the agent can reach the same outcome through another path. For example, the patterns documented in Analysis of Claude Code Security and the ASP.NET machine keys RCE attack both show how hidden execution paths become the real control boundary, not the documented rule text.

These controls tend to break down when the agent can inherit broad workspace permissions, call tools outside the policy engine, or switch contexts through CI/CD, because the rule no longer sits on the same path as the action.

Common Variations and Edge Cases

Tighter policy controls often increase operational overhead, requiring organisations to balance enforcement strength against developer velocity and exception handling. Best practice is evolving here, because there is no universal standard for how much should live in CLAUDE.md versus a central policy layer.

Some teams use CLAUDE.md as a human-readable intent layer and enforce the real control elsewhere, such as in a gateway, repo policy, or agent orchestration layer. That is acceptable if the runtime system can prove the rule was enforced. Other teams try to express approval logic in natural language, but that usually becomes brittle when a request depends on context like environment, customer data, or tool risk. In those cases, the rule may be descriptive but not operational.

Watch for exceptions that look small but matter in practice: temporary admin overrides, nested tool calls, indirect file writes, and hidden side effects from third-party connectors. If the platform cannot observe or restrict those paths, the rule is only advisory. Current guidance suggests using explicit policy evaluation and testing with adversarial scenarios, especially when the agent can touch secrets, production systems, or external APIs. The hard lesson is that a rule is enforceable only when the control can stop the action, not merely describe it.

Related resources from NHI Mgmt Group

• How can teams tell whether front-channel logout is actually working across applications?
• How can teams tell whether data classification is actually working?
• How can teams tell whether access governance is actually working?
• How can teams tell whether AI access is actually under control?