CLAUDE.md Examples

# Project: infra-core

## Conventions
- Terraform for all IaC, no ARM/Bicep
- Use conventional commits
- Run `terraform validate` before plan
- All modules must have examples/

## Guardrails
- Never apply to production directly
- Always run plan before apply
- Never modify state files manually
- Tag all resources with owner + env

# Project: identity-governance

## Conventions
- Microsoft Graph PowerShell SDK only
- Validate CA changes in report-only first
- Follow least-privilege principles
- Reference Graph API v1.0 unless noted

## Guardrails
- Never hardcode tenant IDs
- Never assign permanent Global Admin
- Always use PIM for privileged roles
- Never skip report-only validation