Claude Code for agencies: how to deliver client work with it

An agency can use Claude Code to deliver client work: site builds and rebuilds, migrations, bulk SEO fixes, QA checks and routine maintenance. Claude Code reads the files in a client's repository, edits them, runs builds and checks, and hands the changes to a person for review. What's different for an agency is the setup around it: whose Claude account does the work, who can reach which client repository, where each client's rules live, who approves what ships, and what the client keeps when the engagement ends.

This guide covers that setup as of October 2026, including the parts of Anthropic's terms an agency should read before pricing anything. It is not legal advice; take contract questions to your own counsel.

What Claude Code does in agency delivery

Claude Code suits client work that follows clear rules and can be checked: converting templates, applying one fix across hundreds of pages, redirect maps, structured data, and QA scripts run before each release. Our overview of what Claude Code can do for a business website lists the jobs in detail.

It doesn't replace the account lead or the reviewer. When we rebuilt eseospace.com, about 2,227 URLs, people chose the host, owned brand facts and prices, and approved every deploy, while Claude Code wrote the crawler, the publishing pipeline and the deploy steps. The rebuild case study describes that split. Client work needs the same split, with the client's approvers added.

Which plan, and whose account

The first decision is whose Claude organization the work runs in. Prices are as of October 2026; confirm them on Anthropic's pricing page and in our guide to Claude Code pricing and plans.

On Team and Enterprise, Owners can push server-managed settings to every member, for example blocking the mode that skips permission checks. On consumer plans, Anthropic trains new models on Free, Pro and Max data when the training setting is on, including Claude Code use. Client code belongs on a commercial plan.

What Anthropic's terms say that matters to agencies

Read these four documents yourself: the Commercial Terms, the Consumer Terms, Anthropic's Usage Policy, and the Claude Code legal and compliance page.

Ownership and review

Under the Commercial Terms (version effective June 17, 2025), the customer "retains all rights to its Inputs" and "owns its Outputs," and "Customer Content is Customer's Confidential Information." The same terms put review on you: "It is Customer's responsibility to evaluate whether Outputs are appropriate for Customer's use case, including where human review is appropriate, before using or sharing Outputs." Ownership between you and your client is settled by your contract with the client.

The resale condition, and its scope

The legal page has a section titled "Can customers offer Claude Code in their products?" It covers "preinstalling or running Claude Code in your products or services (e.g. in hosted sandboxes or other agent infrastructure)." Two conditions follow: the Claude Code binary must not be modified, and "Customers may not pay for, resell, or intermediate Claude usage on their end users' behalf. Each end user must authenticate with their own Anthropic API key, Claude subscription plan credentials, or 3P inference provider credential."

On its face, that condition is about offering Claude Code inside a product or service, such as a hosted environment where your clients' people run it. It doesn't describe your own staff using Claude Code to do the work. If you plan to give clients a hosted Claude Code tool, talk to counsel and Anthropic first. The updated Usage Policy, effective November 12, 2026, also bars reselling or proxying access to Claude "through unauthorized means, including services that route requests through consumer subscriptions."

Credentials and names

Anthropic says developers "may not collect, store, or intermediate Claude.ai credentials or session tokens." Never ask a client for their Claude password; their admin invites your people instead. You also can't use the Claude Code or Anthropic names or logos in your own product or company name, or suggest Anthropic endorses your work.

When you build for the client's customers

If you build a chatbot for a client's site, the Usage Policy requires consumer-facing chatbots to "disclose to users that they are interacting with AI rather than a human." Legal or medical advice to an individual needs a qualified person's review first, and the person must be told AI was used. Anthropic's updated policy, posted October 8, 2026, takes effect November 12, 2026; it says those high-risk requirements haven't changed.

Set up each client repository

Each client gets its own repository, folder and rules, and never shares a session with another client.

1. Repository and access. Ideally the client owns the repository and gives your staff the narrowest access the job needs. Start with the repository and a staging copy, not production, and work on a branch. Our agency onboarding checklist lists what to grant and what to hold back.
2. A client CLAUDE.md. Commit a short CLAUDE.md with the build and check commands, the brand and facts file, and what never to touch. Anthropic's target is under 200 lines. Personal preferences go in CLAUDE.local.md, which stays out of git. See how to write a CLAUDE.md for a website.
3. Shared permission settings. Commit .claude/settings.json with deny rules for env files and an ask rule for pushes. Current versions start interactive terminal and VS Code sessions in auto mode, which by default allows pushes to any branch, including main. An ask rule forces a prompt even in auto mode.
4. MCP servers. Add only servers from vendors you trust, with the narrowest access, and test write access on staging. Anthropic says it "does not security-audit or manage any MCP server."
5. Secrets. Never put keys in a prompt or in CLAUDE.md.

A starting settings file:

{
"permissions": {
"deny": ["Read(./.env)", "Read(./.env.*)"],
"ask": ["Bash(git push *)"]
}
}

To check it worked, run /context and confirm the CLAUDE.md appears under memory files, and run /permissions to see the active rules. Our guide to whether Claude Code is safe for production websites explains rule order and the sandbox.

A delivery workflow with review gates

Each stage ends with a person approving before the next begins.

Start a fresh session for each unrelated task, because early instructions can be lost when a long session compacts. And before any deploy, check the git history for changes you didn't make. On our own site, one session once regenerated pages another had just edited, and the edits disappeared.

Automation tied to one person

Routines are scheduled cloud agents, in research preview as of October 2026. The routines docs say they "belong to your individual claude.ai account" and "are not shared with teammates," and that commits and pull requests "carry your GitHub user." They run with no permission-mode picker, and Claude can use a connector's tools, including writes, without asking. Keep client routines to reporting and branch-only changes, and list each one in the handover file.

GitHub Actions can authenticate with an API key or an OAuth token. The GitHub Actions docs say an OAuth token "is tied to the subscription of the person who ran claude setup-token," and recommend a Console API key for a secret shared across repositories. A token from one of your developers stops working for the client when that person leaves.

Who pays for Claude usage

Anthropic bills Claude subscriptions and API usage directly, separately from any agency fee. Write the choice into the contract: whose organization is used, who pays Anthropic, and how usage is reported. Anthropic's cost docs say spend limits can be set "at the organization, group, or individual member level." If you intend to pass Claude costs through to clients, say so plainly in the contract and ask counsel whether your model touches the resale condition above.

Handover when the engagement ends

The full list is in our guide to Claude Code handover documentation. These items are agency-specific.

When not to use Claude Code on a client's site

• The client hasn't agreed to AI-assisted work. Put it in the contract first.
• There is no git history or staging copy, and the client won't allow one.
• The work touches regulated data without the right setup. For health data, Anthropic's BAA covers Claude Code only in the HIPAA configuration on Enterprise (the terminal and the desktop Code tab, not the VS Code or JetBrains extensions) or with zero data retention. Cloud sessions and routines aren't available under that configuration.
• Nobody on your side can review the output with real expertise.

Conclusion

Claude Code can take on much of an agency's repetitive engineering, but the setup decides whether it's safe: commercial plans, one seat per person, per-client rules in each repository, a prompt before every push, a person at every gate, and a handover that doesn't depend on one developer's account. If you want help setting up the accounts, permissions and review process for a team, our Claude Code consulting covers that rollout. More guides are in our Claude Code Guide.

Frequently asked questions