Chapter 16 · Enterprise Configuration and Cost Management

Chapter goals: Master Claude Code's enterprise configuration patterns, understand cost estimation and budget control, and implement team-level deployment strategies.

16.1 Enterprise Configuration Patterns

For team environments, consistent配置 is critical. Claude Code supports three层次的配置:

Level 1: Global Defaults (Corporate-Wide)

// ~/.claude/settings.json — pushed via MDM or group policy
{
  "model": "claude-sonnet-4-20250514",
  "permissions": {
    "allow": ["Bash(npm run test:*)", "Bash(git commit:*)"],
    "deny": ["Bash(rm -rf *)", "Bash(curl * | sh)"]
  },
  "env": {
    "ANTHROPIC_API_KEY": "${VAULT_ANTHROPIC_KEY}"
  }
}

Level 2: Project Conventions (Repo-Level)

// .claude/settings.json — committed to the repo
{
  "permissions": {
    "allow": ["Edit", "Write", "Bash(pnpm test:*)"],
    "deny": ["Bash(git push --force:*)", "Read(.env*)"]
  },
  "model": "claude-sonnet-4-20250514"
}

Level 3: Per-Session Overrides (Ad-hoc)

# Override model for a specific task
claude --model claude-opus-4-20250514 -p "Architect the new module"

# Read-only audit
claude --allowedTools "Read,Grep,Glob,LS" -p "Audit security of this PR"

16.2 Cost Estimation and Budget Control

Real-time Cost Monitoring

> /cost

# Output:
# Session cost: $1.23
# Input tokens: 12,450
# Output tokens: 3,200
# Cache read: 45,000 tokens ( discounted)
# Estimated monthly: $45.00 (based on current trajectory)

Budget Alarming

Set a daily/weekly budget limit and get notified when approaching:

{
  "env": {
    "CLAUDE_CODE_MAX_DAILY_COST": "50.00",
    "CLAUDE_CODE_COST_WARNING_THRESHOLD": "0.8"
  }
}

Cost Optimization Tips

• Use Haiku for简单 queries and batch operations (90% cheaper than Sonnet);
• Cache hits significantly reduce cost — reuse large context instead of re-prompting;
• Compaction keeps conversations concise — trigger /compact before context gets too long;
• For -p one-off tasks, specify the cheapest model that can handle the job.

16.3 Team Deployment Strategies

Strategy 1: Centralized API Key Management

Use a corporate Vault (HashiCorp Vault, AWS Secrets Manager) to distribute API keys:

// ~/.claude/settings.json
{
  "env": {
    "ANTHROPIC_API_KEY": "!vault read -field=key secret/claude/code"
  }
}

Strategy 2: Tiered Model Access

Senior engineers get Opus; juniors get Sonnet; interns get Haiku for simple tasks:

# In .claude/settings.json per team tier
# Senior:
{"model": "claude-opus-4-20250514"}
# Junior:
{"model": "claude-sonnet-4-20250514"}

Strategy 3: CI/CD Pipeline Integration

# .github/workflows/claude-code.yml
name: Claude Code Review
on: [pull_request]

jobs:
  review:
    runs-on: ubuntu-latest
    env:
      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
    steps:
      - uses: actions/checkout@v4
      - name: Install Claude Code
        run: npm install -g @anthropic-ai/claude-code
      - name: Run AI review
        run: |
          git diff origin/main...HEAD > /tmp/pr-diff.txt
          claude -p "Review this PR diff for bugs and security issues" < /tmp/pr-diff.txt \
            > review-output.md
      - name: Post review to PR
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const review = fs.readFileSync('review-output.md', 'utf8');
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: review
            });

16.4 Audit and Compliance

Conversation Audit Trail

All sessions are saved to ~/.claude/projects/. For compliance, archive these regularly:

# Archive last 30 days of sessions
find ~/.claude/projects/ -name "*.jsonl" -mtime -30 -exec tar rf sessions-archive.tar {} +

Policy Enforcement

Use hooks and settings to enforce organizational policies:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "echo \"$TOOL_INPUT\" | grep -qE '(prod|production)' && echo 'BLOCK: No production access allowed' && exit 1 || exit 0"
          }
        ]
      }
    ]
  }
}

Chapter Summary

• Three配置 levels: global (corporate) > project (repo) > per-session (ad-hoc);
• Real-time cost monitoring via /cost; set budget thresholds and warnings;
• Team deployment: centralized key management, tiered model access, CI integration;
• Audit trail via session archives; policy enforcement via hooks.

🧪 随堂测验

点击你认为正确的选项。答错时会展示正确答案与原因解析。

1. Where should corporate-wide default models and permissions be configured?

2. Which model is most cost-effective for simple one-off queries in -p mode?

3. How does Claude Code help control costs in long conversations?

4. Why should API keys be stored in a Vault rather than plaintext in settings.json?

🛠️ Hands-on Practice

1. Configure global defaults in ~/.claude/settings.json with your team's standard model and permission rules.
2. Set up a GitHub Actions workflow that runs Claude Code to review PR diffs and post comments.
3. Use /cost to monitor a long session; then run /compact and compare the cost trajectory before and after.

After completing, proceed to Chapter 17 for best practices and team norms.