Managed settings merge mode gains sandbox config exceptions

Two sandbox config keys are now documented as owned whole by the highest-priority source rather than merged.

Read from

Names in the bundlesandbox.credentials.awsPairssandbox.ripgrep

Since it was published

The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.

Confirmed since 12 Sep 2026 Anthropic's documentation has since written up sandbox.credentials.awsPairs, on All settings. | Values taken whole | Takes the value whole from the highest source that sets it, without combining entries or fields from lower sources. When the highest source doesn't set it, takes it whole from the next source down | [`sandbox.credent… settings-reference see the edit

Confirmed since 12 Sep 2026 Anthropic's documentation has since written up sandbox.ripgrep, on All settings. | Values taken whole | Takes the value whole from the highest source that sets it, without combining entries or fields from lower sources. When the highest source doesn't set it, takes it whole from the next source down | [`sandbox.credent… settings-reference see the edit

How sure we are

Two sources agreeTwo things we can check say the same as this entry.

Anthropic's documentation agreesAnthropic's documentation has since written up sandbox.ripgrep, on All settings.

Anthropic's release notes agreeChanged managedSourcesBehavior: "merge" to take sandbox.credentials.awsPairs and sandbox.ripgrep whole from the highest managed source that…

See this entry in the whole of v2.1.257 →