Enterprise Claude Setup with Workcell

August 5, 2026 ยท View on GitHub

Use this pattern for a shared Claude baseline. It does not mount host home directories in the runtime.

This pattern requires supported Apple Silicon macOS hosts. Workcell has no central enterprise policy or session administration service. Use your host configuration process to distribute reviewed files.

Keep these concerns separate:

  • org-wide instructions in documents.common or documents.claude
  • reviewed Claude API key access in credentials.claude_api_key
  • reviewed MCP state in credentials.claude_mcp
  • optional fail-closed macOS resolver scaffold in credentials.claude_auth

Example policy

version = 1

[documents]
common = "/Users/example/.config/workcell/org-agent.md"
claude = "/Users/example/.config/workcell/claude-overlay.md"

[credentials.claude_api_key]
source = "/Users/example/.config/workcell/claude-api-key.txt"

[credentials.claude_mcp]
source = "/Users/example/.config/workcell/claude-mcp.json"

[credentials.github_hosts]
source = "/Users/example/.config/workcell/github-hosts.yml"
providers = ["claude"]

Why this pattern works

  • the reviewed adapter baseline still controls Claude's default settings
  • workspace CLAUDE.md is imported as a layer instead of becoming the live control plane
  • the session gets only the reviewed credentials it needs
  • the macOS Claude resolver can still be recorded separately, but it is currently fail-closed until a supported export path exists
  • final publication still stays on the host through the repo-local ./scripts/repo-publish-pr.sh wrapper, which delegates to the lower-level workcell publish-pr helper after fresh local parity evidence exists

Launch

workcell --prepare --agent claude --workspace /path/to/repo