Claude Code merges settings from several files with a defined precedence. Reading the order is forgettable; watching a managed policy override your local file is not. Build a deliberate collision at every level.
What to build
- Create a user settings file at ~/.claude/settings.json with a permission rule.
- Create .claude/settings.json in a project with a conflicting rule.
- Add .claude/settings.local.json with a third conflicting rule.
- Pass a fourth via the CLI.
- Record which one wins at each step, then write the precedence order from your own results.
- Verify how permission rules combine — they merge rather than wholesale replace.
Done when
- You can state the precedence order from memory and cite the evidence you gathered.
- You can explain why deny is not simply the absence of allow.
- You know which file belongs in version control and which does not.
- You have confirmed the merge behaviour of permission arrays rather than assumed it.
The trap this exercise teaches
Assuming the most local file always wins. Managed/enterprise policy sits above everything precisely so it cannot be overridden by a project.
Before you start
The theory behind this build is covered in Settings files and precedence. If any step below is unfamiliar, read that first — the exercise assumes it. Primary source: Claude Code Docs — Settings.
Check yourself against the exam
This exercise sits in Domain 2, which is 20% of the CCAR‑F exam. Once you have built it, run a domain drill in the study app and see whether the questions read differently.