Managed settings documentation for the "merge" composition mode now lists sandbox.credentials.awsPairs and sandbox.ripgrep as additional keys owned whole by the highest-priority source rather than merged, joining the existing allowlist exceptions.
Names in the bundlesandbox.credentials.awsPairssandbox.ripgrep
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up sandbox.credentials.awsPairs, on All settings.
| Values taken whole | Takes the value whole from the highest source that sets it, without combining entries or fields from lower sources. When the highest source doesn't set it, takes it whole from the next source down | [`sandbox.credent…settings-reference see the edit
Confirmed since
Anthropic's documentation has since written up sandbox.ripgrep, on All settings.
| Values taken whole | Takes the value whole from the highest source that sets it, without combining entries or fields from lower sources. When the highest source doesn't set it, takes it whole from the next source down | [`sandbox.credent…settings-reference see the edit
Two sources agreeTwo things we can check say the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up sandbox.ripgrep, on All settings.
Anthropic's release notes agree
Changed managedSourcesBehavior: "merge" to take sandbox.credentials.awsPairs and sandbox.ripgrep whole from the highest managed source that…