Claude and Claude Code

38.1 Configuration Surface #

The @import mechanism is the distinctive piece, and it is what makes AGENTS.md interoperation clean:

<!-- CLAUDE.md -->
@AGENTS.md
@docs/architecture-constraints.md

<!-- Claude Code specific below -->
- Prefer `rg` over `grep`. It is installed.

Imports are inlined at load time, so an imported file is prefix on every turn exactly as if it were pasted in. The token discipline in §15.5 applies to the transitive closure, not just the root file.

38.2 Caching Model #

This is the richest explicit control of any provider, and the mechanics are covered in full in Sections 22 and 23. The Claude-specific summary:

• Two modes. Automatic—a single top-level cache_control field, breakpoint moves forward as the conversation grows, best for multi-turn. Explicit—cache_control on individual blocks, for sections that change at different rates.¹²
• Up to four breakpoints. Automatic caching consumes one slot.
• 5-minute TTL by default, refreshed free on every hit; 1-hour available at 2× write.
• Reads at 0.1× base input, with two documented exceptions: 0.025× on Fable 5.1 and Mythos 5.1, and 0.05× on Opus 5.5, where $0.20 per million reads against $4 base input is the rate the pricing table gives. 5-minute writes at 1.25×; 1-hour writes at 2×.¹²
• Minimum cacheable prefix is model-dependent: 512 tokens on Opus 5 and Fable 5.1, 1,024 on Sonnet 5 and Opus 4.8, 4,096 on Haiku 4.5 and Opus 4.6.¹²
• Pre-warming via max_tokens: 0 (§22.6).
• Cache diagnostics beta reports exactly where two consecutive prefixes diverged.

Claude Code places breakpoints on your behalf. The developer’s job is therefore not to configure caching but to avoid breaking it.

A Claude-specific mid-conversation escape hatch: on Fable 5.1, Mythos 5.1, Fable 5, Mythos 5, Opus 4.8, and Opus 5, you can append a {"role": "system"} message inside messages to add an instruction partway through a conversation without invalidating the system or message caches, instead of editing the top-level system field, which does invalidate.¹² This is not available on Sonnet 5.

38.3 Pricing #

Verified September 8, 2026:^12,26

Per million tokens. Batch API applies a 50 percent discount and stacks with caching. No context-length surcharge on the current generation, including at 1M context—a real differentiator against providers with a threshold cliff (§21.3).

38.4 Delegation and Tools #

Subagents get their own context window and only the final message returns—fresh and empty by default, or inheriting the parent conversation and its warm cache when forked (§18.2). The tools frontmatter key is the actual permission boundary and omitting it grants everything (§18.5).

For MCP, defer_loading on a toolset keeps schemas out of the cached prefix until needed:

tools = [{"type": "mcp_toolset", "mcp_server_name": "github",
          "default_config": {"defer_loading": True}}]

Place cache_control on the mcp_toolset entry itself rather than on an individual tool—you do not control tool order within a toolset, and the API applies the breakpoint to the final expanded tool.⁷⁰

38.5 The Control Surface #

• Hooks in .claude/settings.json—the deterministic layer (§19).
• Permission modes—plan mode for read-only exploration is the cheapest safety measure available.
• Sandboxing—the runtime is open-sourced, which makes the isolation claims verifiable rather than asserted.
• Enterprise managed settings—the policy floor, with one qualification to settle before you rely on it as an absolute. Settings merge across five layers, from user through project, project-local, and CLI flags, with the managed enterprise file last, and for scalar values and deny rules a lower layer cannot relax it.⁴⁸ List-valued keys are the exception: Claude Code merges lists across scopes so that each file can add entries, which means an allow-list or exclusion array—sandbox allowed domains and paths, excludedCommands, permissions.allow—takes additions from lower scopes rather than being capped by the managed value. That widens access without overriding anything, and where it matters, allowManagedPermissionRulesOnly is the documented control that closes it for permission rules. This is still where a hook belongs if it must survive contact with a repository an agent can edit (§19.3).
• Checkout isolation for subagents—isolation: "worktree" spawns a delegated agent inside its own git worktree, and Claude Code then refuses edits targeting the main checkout, commands whose working directory resolves there, git redirected there via -C, --git-dir, GIT_DIR/GIT_WORK_TREE or a cd, and commands whose text it cannot verify stay inside the worktree.⁴⁸ Read that as what it is, and note the tool scope: the working-directory check covers Bash, PowerShell and Monitor commands, while the git-redirect and command-shape checks are documented for Bash and Monitor—PowerShell gets the working-directory check alone.⁴⁸ Within that scope, parallel sessions are kept out of each other’s way in the main checkout. It is not an OS filesystem sandbox—writes elsewhere on disk are not its subject, and the worktree still shares the repository’s .git directory. Sandboxing and the permission system are the separate controls for confinement, and they compose with this rather than being replaced by it.

38.6 What Is Distinctive #

The explicit cache control goes further than any competitor’s, which is why Claude is the easiest platform on which to build a high-hit-rate agentic system. The import mechanism solves the multi-file instruction problem cleanly. The remaining friction is that which instruction file loads is now conditional rather than fixed: AGENTS.md is read natively from v2.1.277, but only where no CLAUDE.md or CLAUDE.local.md is present at or above the working directory, with a /config setting to change that and a provider restriction that applied before v2.1.281 and no longer does (§15.2).⁴⁸ The one-line import makes the answer the same everywhere, which is why it stays in the file.