Adds a reading guide, the full 6 permission modes (incl. dontAsk) + auto-mode
admin enablement toggle, confirmed role facts (UsageView roles; full matrix is
external; iam pages 404), deep permission-rule syntax (Bash spacing, Read/Edit
anchors, MCP/Agent), real MCP credential mechanisms (headersHelper/${VAR}/OAuth),
expanded usage/cost/attribution/analytics, plus two big appendices: verbatim
config examples (A1–A10) and step-by-step end-to-end flows (managed-settings
lifecycle, MCP allow/deny worked example, auto-mode force-push decision, auth
credential selection). Sourced from re-fetching the 6 core docs + permission-
modes/permissions/mcp/costs/monitoring-usage/analytics.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Expands §1.2 into a proper three-tier section: positioning per tier, a
capability × tier table (with source + whether the doc is explicit), the
billing differences, and the documented contradiction (authentication lists
"managed policy settings" as Enterprise-only while the server-managed-settings
feature page says Teams+ can use it). Also flags that most controls hinge on
provider (Anthropic-direct + admin write access) rather than subscription tier.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Standalone reading reference faithfully consolidating the six official Claude
docs (admin-setup, authentication, server-managed-settings, settings,
managed-mcp, auto-mode-config): auth methods + precedence, roles/seats/admin,
settings scope precedence & merge rules, server-managed-settings mechanism,
full managed-only/permissions/model/sandbox/MCP key reference, managed-mcp
seven modes + allow/deny evaluation, auto-mode classifier, usage/audit, and
quick-reference tables. No HM design — pure Claude reference for study.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
chenchenandClaude Opus 4.8