When managed settings contain entries that fail schema validation, Claude now writes descriptive errors to stderr at startup:
- For invalid entries that are dropped but don't affect enforcement: "Managed settings contain invalid entries (remaining valid policies are still enforced):"
- For invalid entries that prevent a policy from being enforced at all: "Managed settings failed to load; policies from the failed source are NOT in effect:"
Specific field-level messages include things like "allowedMcpServers" was present but invalid; enforcing an empty allowlist (no MCP servers admitted) until it is fixed.
Evidence
New validation error reporter (search for "Managed settings contain invalid entries")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agree
Fixed managed-settings allowedMcpServers/deniedMcpServers predicates not matching when they use ${VAR} references