Session Goals

What we'll walk through together today

Presenter: Jeremy Proffitt

What Is Claude Code?

Three things working together: orchestration + tools + AI models

Presenter: Jeremy Proffitt

Agents & Terminology

The word "agent" means different things depending on who's talking — let's clear that up

Ally's Infrastructure

How your code stays safe from prompt to response

Bedrock Guardrails

When Claude says no — and what to do about it

🛡 What Are Bedrock Guardrails?

AWS Bedrock Guardrails are safety filters built into the AI infrastructure. They automatically block requests that could violate content policies — protecting you, Ally, and our customers.

🔌 What Triggers Them?

• Requests involving harmful, violent, or illegal content
• Profanity or swear words in your prompt
• Attempts to bypass safety policies
• Sensitive topics outside the model's allowed scope

⚡ What To Do When It Happens

• Use /rewind to undo the last message and try again
• Or use /clear to clear context and start fresh
• Rephrase your request — avoid profanity or triggering language

This is what a guardrail block looks like — it's not an error, just a safety filter doing its job.

Pro tip: Keep prompts professional. No swearing needed — Claude understands plain English just fine! 😊

Session Usage Limits

What limits exist, what they look like, and how to get more

📊 How Usage Limits Work

Each user has an ACU (Anthropic Compute Unit) limit per rolling window. Heavy usage — like large file processing or long sessions — can hit this ceiling. The window resets automatically, usually within an hour.

To request a temporary increase: Your Sr. Director can reset or raise your limit directly in the ACA Management Portal — fast, self-serve, no ticket needed! 🚀

🕵 The Approvals Dashboard

Usage threshold alerts are reviewed by leadership. Sr. Directors can approve, deny, or delegate limit increases for their teams — all time-boxed and auditable.

Good news: Limits exist to ensure fair access across all teams — not to slow you down. If you genuinely need more, the process is easy and fast!

Usage Dashboard

Rolling out to all users — see your own ACU consumption and your team's at a glance

📊 My Usage Tab

Real-time ACU balance, usage history (7–90 days), estimated cost, and per-model breakdown — all in one place.

👥 Team Tab

Leaders see consumption grouped by manager, total ACUs, request counts, and cost — always know where usage is concentrated.

Not Enabled Yet? That's Totally OK!

The error you'll see if your enablement wave hasn't arrived — and exactly what to do next

🔮 What you might see

If Claude Code launches but a request comes back with API Error: 403 and UNAUTHORIZED_GROUP_ACCESS_ERROR, your account hasn't been added to an enablement wave yet. Nothing is broken — you're just a little early!

🎓 1. Finish your Workday training

Complete the Claude Code training in Workday if you haven't already. That's the gate that gets you added to an upcoming enablement wave — easy and self-paced!

🎉 2. Wait for the next wave

Enablement waves run twice a week, the week after your Claude Code enablement. Once your wave runs, access switches on automatically — no ticket, no manual steps.

✅ 3. Re-launch and go

After your wave completes, just restart Claude Code. The 403 disappears and you're in. Seeing this error means install worked and you're already talking to Ally's gateway — the last puzzle piece is the AD group sync.

Presenter: Jackson Sykes

What is settings.json?

Your control panel for Claude Code — everything from permissions to environment variables

// settings.json — full shape
{
  "permissions": {
    "allow": [...],
    "deny": [...]
  },
  "defaultMode": "default",
  "env": {
    "AWS_REGION": "us-east-1",
    "NODE_ENV": "development"
  },
  "hooks": {
    "PreToolUse": [...],
    "PostToolUse": [...]
  },
  "mcpServers": {
    "jira": { "..." },
    "gitlab": { "..." }
  }
}

settings.json — Tips & Quick Wins

Handy things you can configure right away

{
  "attribution": {
    "commit": "Created using Lightspeed 🚀\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
    "pr": ""  // empty = hide from PRs
  }
}

{
  "env": {
    "AWS_REGION": "us-east-1",
    "NODE_ENV": "development"
  }
}

{
  "$schema": "https://json.schemastore.org/claude-code-settings.json",
  ...
}

settings.json — Three Layers

Right file, right scope — user, project, or local override

// Personal defaults — applies to all your projects
{
  "defaultMode": "acceptEdits",
  "permissions": { "allow": ["Read", "Glob", "Grep"] },
  "env": { "AWS_REGION": "us-east-1" }
}

// Team rules — committed to the repo
{
  "permissions": {
    "allow": ["Bash(npm *)", "Bash(terraform fmt *)"],
    "deny":  ["Bash(rm -rf *)", "Bash(git push --force *)"]
  }
}

// Personal, local-only — never committed to the repo
{
  "permissions": { "allow": ["Bash(docker *)"] },
  "mcpServers": { "my-local-tool": { "..." } }
}

Permission Modes

Change how Claude approves actions — set defaultMode in settings.json

// Set in any settings.json layer
{
  "defaultMode": "acceptEdits"
}

The Permission Prompt

Claude Code asks before it acts — every time it wants to touch your system

Your 4 Choices

Know exactly what you're agreeing to before you press a key

Allow & Deny Patterns

Match tools by name, or scope Bash with glob-style command filters

"Read"       // all file reads
"Glob"       // file pattern matching
"Grep"       // search in files
"Write"      // new file creation
"Edit"       // file edits / diffs
"WebFetch"   // outbound HTTP calls
"WebSearch"  // web search
"Bash"       // ALL bash (use carefully!)

"Bash(npm *)"            // npm install, test, run…
"Bash(git status *)"     // read-only git info
"Bash(terraform fmt *)"  // tf formatting only
"Bash(ls *)"             // ls only — NOT lsof
"Bash(ls*)"              // ls AND lsof (no boundary)

"Bash(rm -rf *)"           // recursive delete
"Bash(git push --force *)" // force push
"Bash(wget *)"             // download tool
"Bash(sudo *)"             // privilege escalation
"Read(.env)"               // block reading .env files
"Read(*.env)"              // block local.env, etc.

"mcp__jira__*"                // all Jira tools
"mcp__gitlab__*"              // all GitLab tools
"mcp__jira__search_issues"    // one specific tool
"WebFetch(domain:ally.com)"   // fetches to ally.com only
"Agent(Explore)"              // allow/deny a subagent

Alert Fatigue

The real security risk isn't the prompt — it's ignoring it

Presenter: Blaise Moses

What Is a Session?

A session is your running conversation with Claude — it remembers everything until you clear it

Session Organization

Sessions are scoped to the folder you launch from — each project keeps its own independent history

The Context Window

Claude's working memory is powerful — but it works best when we keep things focused

Subagents: Parallel Workers

Claude Code can spawn specialized subagents to work in parallel without bloating your context

Planning Mode & plan.md

Separate research from implementation for complex tasks

Presenter: Trevor Lewis

It's Not Google. Brief It, Don't Ask It.

The difference isn't length — it's that one briefing gives the tool what it needs

Three Starting Points — Each One Is a Briefing

Pick one, try it Monday — the briefing structure works for all of them