This is exactly how my employer runs Claude. It gets r/w to the cwd and read only access to a bunch of whitelisted nfs. All web access goes through a proxy where internal resources are whitelisted

Proxy also lets you bootstrap auth tokens at proxy layer without giving clause access to the auth identity. Greatly limiting the exfil risk.