Safeguard
Developer Tools•

Where CLAUDE.md files live and the order Claude Code loads them

Managed, user, project and local CLAUDE.md files all load together, not as overrides. Paths per OS, load order, subdirectory loading and monorepo excludes.

Safeguard Security Team
3 min read

Claude Code reads CLAUDE.md from four scopes: managed policy, user, project and local. They do not override each other. All discovered files are concatenated into context, ordered from the filesystem root down to your working directory, so the instruction closest to where you launched Claude is read last.

The four scopes

Anthropic's memory documentation lists them from broadest to most specific.

  • Managed policy: /Library/Application Support/ClaudeCode/CLAUDE.md on macOS, /etc/claude-code/CLAUDE.md on Linux and WSL, and C:\Program Files\ClaudeCode\CLAUDE.md on Windows. This is for organization-wide standards pushed by IT.
  • User: ~/.claude/CLAUDE.md, for personal preferences across all projects.
  • Project: ./CLAUDE.md or ./.claude/CLAUDE.md, shared with the team through version control.
  • Local: ./CLAUDE.local.md, for personal notes in one project. The docs say to add it to .gitignore.

Because the list is in load order, a project instruction appears in context after a user instruction.

How loading works in a directory tree

Claude Code loads CLAUDE.md and CLAUDE.local.md from the current directory and every directory above it. If you start in foo/bar/, you get foo/bar/CLAUDE.md and foo/CLAUDE.md, with foo/ first. Within a directory, CLAUDE.local.md is appended after CLAUDE.md.

Files in subdirectories below your working directory are different. They load on demand, once Claude reads, writes or edits a file in that subdirectory. That keeps a monorepo from loading every team's notes at launch.

Pulling in other files

CLAUDE.md can import files with @path/to/file syntax. Relative paths resolve from the file that contains the import, and imports can nest up to four hops. The documentation notes that imports organize a long file but do not reduce its context cost, because imported files also load at launch.

An import whose path resolves outside your working directory is treated as external. The first time Claude Code meets one in a project, it shows an approval dialog listing the files. That protects you from files other people commit to a shared project.

Monorepos and extra directories

In a large monorepo, other teams' files can get picked up. The docs describe a claudeMdExcludes setting to skip them. The --add-dir flag gives Claude access to more directories, but by default their CLAUDE.md files are not loaded. An environment variable named CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD set to 1 turns that on.

Block-level HTML comments in CLAUDE.md are stripped before the content reaches Claude, so you can leave notes for maintainers without spending tokens.

A short audit routine

  1. Run /context and read the Memory files list.
  2. Delete rules that contradict each other across levels.
  3. Move procedures that matter for one folder into a path-scoped rule or a skill.
  4. Review any CLAUDE.md change in a pull request as carefully as code, since it changes agent behavior.

Quick check

Does a project CLAUDE.md override my user CLAUDE.md?

No. Both are concatenated. The project file appears later in context, so it is read after the user file.

Do CLAUDE.md files in subfolders load at launch?

No. They load when Claude touches a file in that subfolder.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.