What
A new enterprise settings key, managedSourcesBehavior, accepts "first-wins" (the default, and exactly today's behaviour) or "merge". Under first-wins the highest-priority managed source present is the whole managed tier. Under merge, all present managed sources are deep-merged with fixed precedence and arrays unioned, so a lower source can contribute keys instead of being discarded. Any admin who sets the key gets it on this build; everyone else sees no change.
Details
- Managed source precedence is server-managed, then MDM / OS policy, then
managed-settings.json. - Some keys never merge and are owned whole by the highest source present:
fallbackModel, the restriction allowlists (allowedMcpServers,availableModels,strictKnownMarketplaces,allowedChannelPlugins) and the login pins (forceLoginOrgUUID,forceLoginMethod,forceLoginGatewayUrl). - The key is only honored when set in the highest-priority source, so a lower source cannot opt itself into merging.
- Windows HKCU settings and
--managed-settingsnever take part in the merge. - The key is stripped from the settings object before composition, so it never leaks into effective settings. It does not exist in 2.1.241.
Evidence
managedSourcesBehavior
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundlemanagedSourcesBehavior
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up managedSourcesBehavior, on Claude apps gateway for Amazon Bedrock, Claude Platform on AWS, Google Cloud, and Microsoft Foundry.
The hooks lock and `allowManagedPermissionRulesOnly`'s effect on the developer's own rules need the winning source by default; under the `managedSourcesBehavior` merge opt-in in [how Claude Code combines managed sources](/docs/en/managed-s…claude-apps-gateway see the edit
Added since
A small documentation edit on Configure server-managed settings touched a line naming managedSourcesBehavior after this was published.
* **Gateway sign-in keys**: Claude Code never reads [`forceLoginGatewayUrl`](/docs/en/settings-reference#forcelogingatewayurl) or the `"gateway"` value of [`forceLoginMethod`](/docs/en/settings-reference#forceloginmethod) from server-manag…server-managed-settings see the edit
Two sources agreeTwo things we can check say the same as this entry.
Anthropic's documentation agrees
A small documentation edit on Configure server-managed settings touched a line naming managedSourcesBehavior after this was published.
The name it cites is new in this build
New in this build: managedSourcesBehavior