IT & security · For CTO
Ship internal software faster with Claude Code, with a person approving every change
- Claude
- GitHub
- Azure
- Teams
The short answer
Claude Code works alongside your engineers inside their normal code and collaboration tools. It drafts, tests and explains changes to internal software, so routine builds and fixes move faster. Every change is shown to a person, who reviews and approves it before anything goes live, keeping control and accountability where they belong.
Key takeaways
- Internal software backlogs are a hidden drag on productivity, and Claude Code shortens the path from request to working tool.
- Claude drafts and tests changes; named engineers review and approve every release.
- Engineers keep their existing access rights, code review rules and deployment controls.
- Typical teams see faster delivery of routine internal tools, freeing senior engineers for harder problems.
Executive summary
Every organisation has a queue of small but important internal needs: a report that someone rebuilds by hand each week, an integration between two systems that never quite talks, a simple internal app that a team has waited months for. These requests compete with larger projects and often stall. Claude Code is an AI coding assistant from Anthropic that works with your engineers inside the tools they already use, including GitHub and Azure. It helps them build, update and test internal software more quickly. Crucially, nothing reaches users until a named engineer has reviewed the change and approved it, just as it would for any other code. For a CTO, this means a shorter backlog, more time for complex engineering, and no loss of control over quality or security.
What is the business problem, and what does it cost?
Most IT teams are asked for far more than they can deliver. Internal requests are often small in isolation: a dashboard for operations, a data export for finance, a workflow that moves approvals from e-mail into a proper tool. Each one waits in a queue, sometimes for months, because senior engineers are busy with larger priorities.
The hidden cost is larger than the backlog itself. Business teams build fragile workarounds in spreadsheets, staff re-key data by hand, and decisions are made on stale information. Engineers lose time to repetitive build work rather than to the design choices that really need their judgement.
- Requests wait weeks or months in the backlog.
- Teams create manual workarounds that carry operational and accuracy risk.
- Senior engineers spend time on routine builds instead of architecture and security.
What changes when engineers work with Claude Code?
Claude Code acts as a capable assistant inside your engineers' existing workspace. An engineer describes what a tool should do, and Claude proposes the code, explains its reasoning, writes tests and points out likely problems. The engineer stays in charge of the direction and the decisions.
The result is that routine builds and changes can be completed in a fraction of the usual time. Teams typically see routine internal tools delivered in days rather than weeks, with more of the engineering effort going into design, quality and security rather than repetitive typing.
- Engineers describe the outcome; Claude drafts the solution and tests.
- Routine integrations and reports are delivered sooner.
- Senior engineers focus on architecture, risk and difficult problems.
How does Claude connect to GitHub, Azure and Teams?
Your source code already lives in GitHub, where your team tracks changes, reviews them and keeps a full history. Claude Code works within this same workflow, so each proposed change arrives as a normal proposed update that a colleague can read, question and approve. Nothing bypasses the review process you already have.
Applications are deployed into your own Microsoft Azure account, so they run where your other systems run. Teams is used as the place where people discuss requests, receive release notifications and follow progress, keeping everyone informed in a tool they already use every day. Claude can connect to these tools through secure, approved links, so it only works with what the engineer is permitted to access. A closely related automation is An IT helpdesk in Teams that solves the common requests itself. A closely related automation is Access requests approved quickly, safely and with a full audit trail. For the organisation-wide picture, see how Claude and Microsoft 365 work together. It is built on Claude Code, from Anthropic.
- Changes are proposed in GitHub and reviewed like any other code.
- Applications deploy into your own Azure account.
- Teams carries requests, updates and release notices.
A day in the life: before and after
Consider an operations analyst who needs a weekly report that combines data from three internal systems. Before, an engineer spends most of a day building the export, then a second day fixing edge cases. Requests queue behind larger work, so the report often arrives late or not at all.
After, the engineer describes the report in plain terms. Claude Code drafts the integration and tests it against sample data. The engineer reviews the change in GitHub, checks it against security rules, and approves it. The report goes live within days, and the analyst receives a Teams notice when it is ready.
- Before: a week of queued requests and manual rework.
- After: a reviewed, tested tool in days, with the requester kept informed.
How are governance, security and permissions protected?
Speed is only valuable if control is preserved. Claude Code operates within your existing rules: branch protections, mandatory peer reviews, automated security scanning and deployment approvals all still apply. A person must approve each change before it is merged and released.
Access follows existing permissions. Claude only works with the code repositories and systems each engineer is already allowed to use. Every change leaves a traceable record in GitHub, and deployments are logged in Azure, giving your security and audit teams a clear trail to review.
- Mandatory human review and approval before any release.
- Existing repository permissions and security scanning remain in force.
- Every change has an auditable history in GitHub and Azure.
How should success be measured?
Measure what matters to the business. Track the time from request to live tool, the size of the backlog, the number of manual workarounds retired, and the share of engineering time spent on higher-value work. Also track quality indicators such as defects found after release and the number of changes returned in review.
Review these measures monthly with the leadership team. Early improvements tend to appear within the first quarter, once engineers have settled into the new working pattern and the first batch of backlog items is cleared.
- Time from request to live internal tool.
- Backlog size and number of manual workarounds retired.
- Defects after release and changes returned in review.
How should an organisation start?
Start with a free automation audit. The audit identifies the internal requests that would benefit most, reviews your current code and approval processes, and confirms where Claude Code fits safely. We recommend beginning with a small number of low-risk internal tools so that your team can build confidence before wider use.
Set clear ownership from the beginning: name the engineers who approve changes, the leaders who prioritise requests, and the people responsible for security sign-off. With these roles agreed, the rollout can proceed in controlled steps.
- Book a free automation audit to identify the best first candidates.
- Start with low-risk internal tools and expand as confidence grows.
- Agree named approvers and security sign-off before the first release.
How it works
Describe the need
An engineer or business owner explains the outcome the internal tool should achieve.
Claude drafts the solution
Claude Code proposes the code, explains its reasoning and writes tests inside the engineer's workspace.
Engineer reviews
The change appears as a proposed update in GitHub, where a colleague reads, questions and checks it.
Security checks run
Existing automated scanning and branch rules test the change against your standards.
Person approves release
A named approver signs off before the change is merged and deployed to your Azure account.
Requester is informed
Teams carries the release notice, and the requester sees the tool go live.
Before and after
Building a weekly operations report
BeforeQueued for weeks, then built over several days with manual fixes.
AfterDrafted, tested and reviewed within days, with an audit trail.
Connecting two internal systems
BeforeCustom integration built slowly, with knowledge held by one engineer.
AfterIntegration documented, reviewed by peers and maintained by the team.
Updating an existing internal app
BeforeSmall changes wait behind larger projects.
AfterRoutine updates handled quickly, with each change still approved.
Tracking progress on requests
BeforeStatus chased by e-mail and hallway conversations.
AfterRequests and releases visible in Teams to everyone involved.
What leaders typically see
- 30–50%Typical reduction in time to deliver routine internal tools
- Days, not weeksTypical turnaround for small, low-risk internal changes
- 100%Changes reviewed and approved by a named person before release
Typical ranges. Your free audit sets a baseline for your own organisation.
What it means for each leader
- CTO
- Shorter backlog and more senior engineering time for architecture and security.
- CISO
- Existing review, scanning and access controls stay in force, with a full audit trail.
- COO
- Operational teams receive working tools sooner, replacing manual workarounds.
- CFO
- Less spend on routine build work and fewer errors from manual processes.
- CHRO
- Engineers spend more time on meaningful work, supporting retention and morale.
United States, United Kingdom, India and the Middle East
United States
Organisations in the United States may need to consider state privacy laws such as California's CCPA/CPRA and sector rules, for example HIPAA in healthcare or SOX for public companies, when internal tools touch personal or financial data. US hosting is available in Azure, and the design can be shaped to support these expectations.
United Kingdom
UK organisations will consider UK GDPR and the Data Protection Act 2018, together with sector regulators such as the FCA or NHS guidance where relevant. UK hosting is available, and access controls and review steps can be designed to support these obligations.
India
Indian organisations will consider the Digital Personal Data Protection Act, 2023 and sector regulators such as RBI, SEBI or IRDAI where relevant. India hosting is available, and the approval workflow can be configured to meet internal governance expectations.
Middle East
Organisations in the UAE and Saudi Arabia will consider the UAE Personal Data Protection Law, Saudi Arabia's Personal Data Protection Law overseen by SDAIA, and free-zone rules such as DIFC or ADGM where they apply. Data-residency needs are assessed in the audit and the deployment region is chosen to meet them; in-country hosting is not guaranteed.
Safeguards built in
- Named human approver for every change before release.
- Existing repository permissions and branch protections remain in place.
- Automated security scanning applied to all proposed changes.
- Full traceable history of changes in GitHub and deployments in Azure.
- Claude only accesses systems each engineer is already permitted to use.
- Clear policy on which data and systems are out of scope for AI assistance.
From audit to rollout
Free automation audit and selection Weeks 1–2
Identify the internal requests with the best return and confirm where Claude Code fits safely within your current processes.
Pilot with low-risk tools Weeks 3–8
Build a small number of internal tools with a named approval team, measuring delivery time and review quality.
Refine governance and training Weeks 9–12
Adjust approval rules, security sign-off and team practices based on pilot results.
Scale across the engineering team Weeks 13 onward
Extend the approach to wider internal backlogs, with monthly reviews of measures and risk.
The Claude products behind it
How engineers build and change software with Claude.
The API used to build custom Claude applications.
Frequently asked questions
What does doing nothing cost us?
Doing nothing usually means the internal backlog keeps growing, business teams keep building fragile workarounds, and senior engineers stay tied up in routine work. The cost is hard to see on a single invoice but appears in delayed decisions, manual errors and lost engineering capacity.
Can Claude Code release changes without a person approving them?
No. The design requires a named person to review and approve each change before it is merged and deployed. Claude drafts and tests the work; people decide what goes live.
Where is our data and code held?
Code stays in your GitHub organisation and applications deploy into your own Azure account. Hosting region is chosen in the free audit to meet your data residency needs, including India, the United States, the United Kingdom or the European Union.
How accurate is the code Claude produces?
Claude's output is reviewed, tested and scanned like any other code, so errors are caught before release. Teams track defects after release and the number of changes returned in review to measure quality over time.
Will this replace our engineers?
No. The approach is designed to free engineers from repetitive build work so they can focus on architecture, security and complex problems. Engineers remain accountable for every release.
How long before we see results?
Many teams see early improvements within the first quarter, once the first batch of low-risk tools has been delivered and the review routine is established. Timelines depend on the size of your backlog and approval processes.
Which Microsoft tools and licences do we need?
You need your existing GitHub and Azure accounts, plus Microsoft Teams for communication. The audit confirms which licences and permissions are required for your environment.
Can this work in our offices outside the United States?
Yes. The approach works for organisations in the United Kingdom, India and the Middle East. Regional privacy and sector rules are assessed during the audit, and the hosting region is chosen accordingly.