{"version":"2.1.235","anchor":"policy-helpers-can-now-be-delivered-by-remote-settings-but","canonical_anchor":"policy-helpers-can-now-be-delivered-by-remote-settings-but","heading":"Policy helpers can now be delivered by remote settings, but only after an explicit consent record \u2014 and they run in a scrubbed environment","tier":"internal","area":"Policy Helpers","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.235\/e\/policy-helpers-can-now-be-delivered-by-remote-settings-but","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.235","markdown":"### Policy helpers can now be delivered by remote settings, but only after an explicit consent record \u2014 and they run in a scrubbed environment\n\nRemote-delivered policy helpers now require explicit consent and run with a scrubbed environment\n\n`policyHelpers` previously only came from admin sources (MDM or managed settings). It can now also be armed from `remote` settings, but a remote-armed helper won't run until its payload is both verified and explicitly consented to; without consent it logs \"not yet approved in the managed-settings dialog\" and emits `settings_policy_helpers_per_os` \/ `remote_consent_missing` telemetry. Consent is stored under `remote-settings-helper-consent` (now included in the purge list), is revoked automatically if the payload changes, and revoking mid-execution discards the helper's output.\n\nA remote-armed helper also runs in a hardened environment: known secret variables like `ANTHROPIC_API_KEY`, `AWS_SESSION_TOKEN`, and `GOOGLE_APPLICATION_CREDENTIALS`, plus loader-hijack variables such as `LD_`, `DYLD_`, `NODE_OPTIONS`, and `GIT_` prefixes, are stripped, and `PATH`\/`HOME`-like variables are pinned to fixed values under `\/var\/empty\/claude-code-policy-helper` (or the Windows equivalent). This only applies to organizations whose remote settings include a per-OS `policyHelpers` entry and who approve it.\n\n- Area: Policy Helpers\n- Tier: Under the hood\n- Useful: 3\/5\n- Signal: 4\/5"}