If you say in your CLAUDE.MD that a certain directory is read only inputs, Claude Code will actually enforce that and deny any write to that directory by the agent. To name just one example.

...maybe. If there are any actual consequences if that software's invariants are violated you're better off using an external sandboxing mechanism. There are many excellent quality, battle tested options to choose from that you can actually rely on. Trusting claude code for this is highly questionable behavior for an organization, and would really throw the rest of their security posture into doubt IMO. Like if I learned a company was letting clod play in the same sandbox as developers' ssh keys, vpn certs, etc I'd take steps to make sure my organization absolutely never uses their software.