A school-district settings.json must constrain Claude Code for student-project sessions. Which configuration goal fits?

Student-project Claude Code sessions in a school district must operate under explicit capability constraints, so disabling risky shell tools in settings.json is the correct configuration goal. Settings-level denylists keep the agent inside approved file and command surfaces, reducing accidental destructive actions while students still receive useful coding help on assigned projects.

Enabling unrestricted shell tools for every student session fails conceptually because classrooms are not production ops floors—unbounded shell access invites data loss, lateral movement, and policy violations that the district cannot defend. Deleting settings.json so students inherit no capability limits fails because removing the constraint file restores default breadth rather than enforcing least privilege. Storing student API keys in a public settings.json commit fails as a security and privacy error: credentials belong in secret stores or per-user env injection, never in versioned public config.

Exam caveat: tool lockdown must still leave enough capability for the learning objective—over-blocking can push students toward unsafe workarounds outside the controlled environment. Operational check: inventory allowed tools in settings.json, run a student-role smoke session that attempts a denylisted shell command, and confirm the agent refuses while still completing a permitted file-edit task.