Excluding files and controlling project scope

How to keep Claude away from files it should not read, and what actually enforces it.

4 min read · Lesson 10 of 11 in this domain

There are two different questions that sound alike: "what should Claude not read" and "what should not enter context automatically". They have different mechanisms. Keeping Claude away from a file is a permission question, enforced by the harness through deny rules — this is the one that gives a guarantee, and it is what you use for secrets. Keeping instruction files out of context is a memory question, handled by claudeMdExcludes. Conflating them leads to the classic mistake of trying to protect credentials with something that was only ever a context filter.

• permissions.deny with a Read(./.env) or Read(./secrets/**) rule is the enforced mechanism for keeping Claude out of a path.
• Deny rules merge across every settings scope, so a deny added at any layer still applies.
• claudeMdExcludes filters which CLAUDE.md files load into context — a context-weight control, not a security boundary.
• It matches glob patterns against absolute paths, and its arrays merge across settings layers.
• Managed policy CLAUDE.md files cannot be excluded, by design.
• .gitignore governs what git tracks and has no effect on what a tool can read from disk.

Source: Claude Code Docs — Settings · Independent study aid, not affiliated with or endorsed by Anthropic.