{"name":"allowManagedPermissionRulesOnly","slug":"allowmanagedpermissionrulesonly","family":"setting","title":"Settings keys","noun":"settings key","description":"Make [managed settings](\/docs\/en\/managed-settings.md) the only settings source of [permission rules](\/docs\/en\/permissions.md#managed-settings)","description_source":"docs","described_by":{"doc":"claude-code\/settings-reference","title":"All settings"},"presence":{"first_seen":"2.1.138","removed_in":"2.1.284","in_current_build":false,"newest_mined":"2.1.309","builds":126,"mined_builds":150,"first_cited":{"version":"2.1.282","released_at":"2026-09-24 15:56:22","spans":6}},"aliases":[],"entries":[{"version":"2.1.309","anchor":"managed-only-settings-list-adds-hook-settings","heading":"Three hook settings join Claude Code's managed-settings list","line":"disableAllHooks, allowedHttpHookUrls and httpHookAllowedEnvVars now sit on the same settings list as allowManagedHooksOnly","released_at":"2026-10-22 20:34:13","reason":"named in this entry, found in this entry's text"},{"version":"2.1.305","anchor":"managed-rules-setting-now-affects-plugin-trust-check","heading":"allowManagedPermissionRulesOnly now affects a plugin trust check","line":"When managed settings set allowManagedPermissionRulesOnly, one check on whether a plugin source is trusted now fails","released_at":"2026-10-20 19:29:36","reason":"found in this entry's text, named in this entry"},{"version":"2.1.305","anchor":"managed-allowmanagedpermissionrulesonly-docs-desktop-plug","heading":"allowManagedPermissionRulesOnly help narrows when --plugin-dir plugins keep their tools","line":"The setting's description now says plugins loaded with `--plugin-dir` keep their allowed tools only in Claude Desktop, and only if your organization didn't set it","released_at":"2026-10-20 19:29:36","reason":"found in this entry's text, named in this entry"},{"version":"2.1.284","anchor":"allowmanagedpermissionrulesonly-plugins-keep-allowed-tools","heading":"Managed-rules lockdown keeps plugin tool permissions only from admin-backed sources","line":"Under `allowManagedPermissionRulesOnly`, only plugins from admin-backed sources keep their allowed-tools grants; other plugins' grants are ignored","released_at":"2026-09-28 17:11:59","reason":"found in this entry's text, named in this entry"},{"version":"2.1.284","anchor":"plugin-skill-allowed-tools-under-managed-only-policy-now-con","heading":"Managed-only permission policy now considers where a plugin came from","line":"Under `allowManagedPermissionRulesOnly`, plugin skills can keep their allowed tools based on official attestation or marketplace source","released_at":"2026-09-28 17:11:59","reason":"found in this entry's text, named in this entry"},{"version":"2.1.284","anchor":"managed-permissions-policy-marketplace-npm-sources-must-pin","heading":"Admin-only permission rules require npm plugin marketplaces to pin a registry","line":"With `allowManagedPermissionRulesOnly` set, npm-based marketplaces keep their plugins' allowed-tools only when a registry is pinned","released_at":"2026-09-28 17:11:59","reason":"found in this entry's text, named in this entry"},{"version":"2.1.282","anchor":"allowmanagedpermissionrulesonly-now-also-ignores-allowed","heading":"Managed-only permission rules now also cover skills' allowed-tools lists","line":"With `allowManagedPermissionRulesOnly` on, user and project skills and commands can no longer grant themselves tools through `allowed-tools`","released_at":"2026-09-24 15:56:22","reason":"found in this entry's text, named in this entry"},{"version":"2.1.282","anchor":"status-shows-when-permission-rules-are-limited-to-managed-s","heading":"\/status explains when only managed permission rules apply","line":"When an organisation limits permission rules to managed settings, `\/status` now shows a row listing any allowed tools that were ignored","released_at":"2026-09-24 15:56:22","reason":"found in this entry's text, named in this entry"},{"version":"2.1.282","anchor":"coordinator-no-longer-advertises-skill-tool-grants-from-untr","heading":"Skill tool grants from untrusted sources are no longer offered to workers under managed-only rules","line":"With `allowManagedPermissionRulesOnly` set, skills from untrusted sources no longer tell worker agents they grant extra tool permissions","released_at":"2026-09-24 15:56:22","reason":"found in this entry's text"},{"version":"2.1.282","anchor":"allowed-tools-in-skills-and-plugin-commands-ignored-under-al","heading":"Skills and plugin commands can no longer grant themselves tools under managed-only permission rules","line":"When policy restricts permission rules to managed settings, tool grants written into skills and plugin commands are ignored","released_at":"2026-09-24 15:56:22","reason":"found in this entry's text"}],"entries_total":11,"docs":[{"source":"claude-code","path":"settings-reference","title":"All settings","documented":true},{"source":"claude-code","path":"settings","title":"Claude Code settings","documented":true},{"source":"claude-code","path":"admin-setup","title":"Set up Claude Code for your organization","documented":false},{"source":"claude-code","path":"agent-sdk\/skills","title":"Extend agents with skills","documented":false},{"source":"claude-code","path":"changelog","title":"Claude Code changelog","documented":false},{"source":"claude-code","path":"claude-apps-gateway","title":"Claude apps gateway for Amazon Bedrock, Claude Platform on AWS, Google Cloud, and Microsoft Foundry","documented":false},{"source":"claude-code","path":"claude-apps-gateway-config","title":"Claude apps gateway configuration","documented":false},{"source":"claude-code","path":"desktop","title":"Desktop application","documented":false},{"source":"claude-code","path":"hooks","title":"Hooks reference","documented":false},{"source":"claude-code","path":"managed-mcp","title":"Control MCP server access for your organization","documented":false}],"docs_total":14,"gates":[],"related":[],"url":"https:\/\/changelogs.core-directive.com\/reference\/setting\/allowmanagedpermissionrulesonly","family_url":"https:\/\/changelogs.core-directive.com\/reference\/setting.json"}