CLAUDE.md Hierarchy — Project / User / Enterprise Cascade

Key Takeaways

• The CLAUDE.md resolution order is Enterprise → Project → User; enterprise constraints are operator-tier and cannot be overridden by lower scopes — treat this exactly like an OAuth authorization-server scope that downstream services cannot escalate.
• Project-level CLAUDE.md governs shared, team-wide context for a repository or workspace; user-level CLAUDE.md supplies personal workflow preferences but must stay within the envelope that enterprise and project layers have already defined.
• In large-scale deployments (Aaranya IT, Aaranya IT, Aaranya IT style monorepos), enterprise CLAUDE.md should encode compliance guardrails — PII handling, secrets-detection rules, approved tool lists — as policy-as-code so that no individual project or user config can accidentally widen the security perimeter.
• Memory anchor: Config cascade — Enterprise is the API Gateway, Project is the service mesh policy, User is the sidecar preference; traffic always flows downstream, never upstream.