Claude Code architecture and the execution model
What actually runs where, and why that determines what you can enforce.
5 min read · Lesson 9 of 11 in this domain
Claude Code is a harness around the same Messages API loop you would write yourself, with three layers worth separating in your head. The model decides what to do. The harness — the client on your machine — decides what is permitted and actually executes it. The configuration shapes both, but through two very different channels: instruction files that persuade the model, and settings and hooks that constrain the harness. Almost every Domain 2 question reduces to knowing which channel a given requirement belongs to. Anything phrased as a guarantee lives in the harness layer, because that is the only layer the model cannot reason its way around.
- Tools are executed by the client on your machine, not by the model — which is why permissions and hooks can stop them and prose cannot.
- Instruction files (CLAUDE.md, rules, skills) are delivered to the model as context; settings, permissions and hooks are enforced by the harness.
- Session continuity comes from the transcript the harness maintains and resends; the API itself holds nothing between requests.
- The Agent SDK is this same harness exposed as a library, so the mental model transfers directly to programmatic use.
- Subagents get their own context and their own tool scope, executed by the same harness under the same permission rules.
Questions blur 'the model decides' with 'the model executes'. It never executes — that is the harness, and that distinction is what makes enforcement possible.
Who executes a Bash tool call in Claude Code?
This is exactly why a PreToolUse hook or a deny rule can stop it.
A requirement is phrased as 'must never happen'. Which layer must implement it?
The other three are all context the model weighs rather than constraints it obeys.
Practise this domain with 20%%-weighted questions in the study app.
Open in study appSource: Claude Code Docs — Settings · Independent study aid, not affiliated with or endorsed by Anthropic.