{"name":"managed.policies","slug":"managed-policies","family":"setting","title":"Settings keys","noun":"settings key","description":"Gateway operators get startup errors for bad desktop policy keys instead of silently passing them through.","description_source":"entry","described_by":{"version":"2.1.232","anchor":"gateway-desktop-policy-overlays-are-validated-before-serving"},"presence":{"first_seen":null,"removed_in":null,"in_current_build":false,"newest_mined":"2.1.308","builds":0,"mined_builds":149,"first_cited":{"version":"2.1.296","released_at":"2026-10-09 16:58:10","spans":1}},"aliases":[],"entries":[{"version":"2.1.296","anchor":"managed-policies-accept-a-code-key-as-alternative-to-cli","heading":"Managed policy entries can carry a code section as well as cli","line":"Entries in `managed.policies` now accept a `code` key in addition to `cli`, and validation messages point to whichever one the entry uses","released_at":"2026-10-09 16:58:10","reason":"found in this entry's text, named in this entry"},{"version":"2.1.283","anchor":"managed-policies-deniedmodels-from-the-catch-all-policy-is","heading":"Models denied in the catch-all managed policy now apply to every policy","line":"`deniedModels` in the catch-all `managed.policies` entry is now combined with each specific policy's list instead of being replaced by it","released_at":"2026-09-25 18:46:11","reason":"found in this entry's text, named in this entry"},{"version":"2.1.281","anchor":"self-hosted-gateway-bedrock-guardrail-and-assume-role-tele","heading":"Self-hosted gateway: Bedrock guardrail and assume_role, telemetry resource_attributes, serve_to_desktop","line":"The self-hosted gateway config adds Bedrock guardrails and `assume_role`, telemetry `resource_attributes`, and `serve_to_desktop` for policies","released_at":"2026-09-23 17:01:17","reason":"found in this entry's text"},{"version":"2.1.232","anchor":"gateway-desktop-policy-overlays-are-validated-before-serving","heading":"Gateway desktop: policy overlays are validated before serving","line":"Gateway operators get startup errors for bad desktop policy keys instead of silently passing them through.","released_at":"2026-08-13 21:30:53","reason":"named in this entry, found in this entry's text"},{"version":"2.1.232","anchor":"managed-policy-cli-documents-are-checked-for-alias-collision","heading":"Managed policy CLI documents are checked for alias collisions","line":"Gateway configs now fail validation if a setting appears under both an alias and its canonical name.","released_at":"2026-08-13 21:30:53","reason":"found in this entry's text"}],"entries_total":5,"docs":[{"source":"claude-code","path":"changelog","title":"Claude Code changelog","documented":false},{"source":"claude-code","path":"claude-apps-gateway","title":"Claude apps gateway for Amazon Bedrock, Claude Platform on AWS, Google Cloud, and Microsoft Foundry","documented":false},{"source":"claude-code","path":"claude-apps-gateway-config","title":"Claude apps gateway configuration","documented":false},{"source":"claude-code","path":"claude-apps-gateway-deploy","title":"Claude apps gateway deployment and operations","documented":false},{"source":"claude-code","path":"claude-apps-gateway-on-aws","title":"Deploy Claude apps gateway on AWS","documented":false},{"source":"claude-code","path":"claude-apps-gateway-on-gcp","title":"Deploy Claude apps gateway on Google Cloud","documented":false}],"docs_total":6,"gates":[],"related":[{"name":"managed","slug":"managed","description":"Usage records now say whether cost came from built-in prices, your org's rates, or a guess."},{"name":"managedHooksOnly","slug":"managedhooksonly","description":"After Claude Code picks which hooks apply, it now runs one more check that is told whether managedHooksOnly is set"},{"name":"managedInstructionsOnly","slug":"managedinstructionsonly","description":"Subagents can now be restricted to only use 'Managed' instruction sources"},{"name":"managedMcpServers","slug":"managedmcpservers","description":"Provide remote [MCP servers](\/docs\/en\/managed-mcp#provide-servers-through-managed-settings) to every user alongside the ones they add"},{"name":"managedSourcesBehavior","slug":"managedsourcesbehavior","description":"Compose every [managed source](\/docs\/en\/managed-settings#how-claude-code-combines-managed-sources) you deploy instead of using the highest-priority one alone"}],"url":"https:\/\/changelogs.core-directive.com\/reference\/setting\/managed-policies","family_url":"https:\/\/changelogs.core-directive.com\/reference\/setting.json"}