Keep installation and updates traceable
Choose the official installation route for your operating system. Check the version with claude --version and use claude doctor for setup diagnostics. Updates depend on how the installation was performed: native installers and package managers follow different routes. Record the method instead of unknowingly maintaining multiple installations.
Assess the platform and protection boundary together
The official setup documents sandbox support for WSL 2 but not native Windows or WSL 1. The Bash sandbox constrains commands and their child processes; permission rules also cover other tools. If a pilot requires technical isolation, the chosen environment must actually provide it. An instruction in a prompt does not substitute for it.
Accept the first task through its diff
Start in a test repository without production credentials. Use a known issue with clear acceptance criteria. Review requested permissions, the diff and relevant tests together. If additional network destinations or tools become necessary, justify each access. This run establishes whether the setup fits the engineering workflow.
Decision matrix
| Decision point | Proceed when | Stop when |
|---|---|---|
| Working environment | Documented: runtime, sign-in, repository rules, sandbox, network and tests. | Scope, data or accountability remains unresolved. |
| Isolated functional test | A recorded test in an isolated repository shows the workspace, requested permissions, a small traceable change and its test result. The subsequent review explains the change. | There is only an unevaluated demo without acceptance evidence. |
| Operational readiness | Owner, approval, fallback and next review date are defined. | Avoid: broad permissions and production access before the first test. Successful sign-in or installation is insufficient for approving production access; permissions and effects need to be checked against the bounded test assignment. |
Keep it verifiable
Primary sources
- Anthropic: Claude Code advanced setupSource checked:
- Anthropic: Configure the sandboxed Bash toolSource checked:
