{"version":"2.1.232","anchor":"catch-all-and-role-desktop-overlays-merge-by-meaning","canonical_anchor":"catch-all-and-role-desktop-overlays-merge-by-meaning","heading":"Catch-all and role desktop overlays merge by meaning","tier":"notice","area":"Managed Settings","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.232\/e\/catch-all-and-role-desktop-overlays-merge-by-meaning","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.232","markdown":"### Catch-all and role desktop overlays merge by meaning\n\nCatch-all gateway policies merge desktop overlays key by key, so a strict base can't be loosened accidentally.\n\n**What**\n\nA gateway policy that inherits from the catch-all entry (`match: {}`) now merges its desktop overlay semantically instead of overwriting keys wholesale, so a stricter base cannot be loosened by accident.\n\n**Details**\n\n- `disabledBuiltinTools` from the base and the role entry are unioned rather than replaced.\n- `builtinToolPolicy` is merged so a base value other than `allow` survives a looser role value.\n- The merged result is diffed and the changed keys are logged, matching what the `cli` half of a policy already did.\n\n**Evidence**\n\n`desktop overlay after merge with catch-all base`\n\n- Area: Managed Settings\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5"}