The same widening protection now applies to settings.permissions.defaultMode: if a project or local settings file would widen the effective permission mode, that widening is ignored. This is logged via the new tengu_settings_mode_widening_carry_ignored telemetry event.
Names in the bundlepermissions.defaultMode
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Added since
A small documentation edit on Set up Claude Code for your organization touched a line naming permissions.defaultMode after this was published.
| [Starting permission mode](/docs/en/permission-modes#which-mode-a-session-starts-in) | Choose the permission mode your developers' terminal sessions start in instead of the built-in starting permission mode, or remove auto mode. [Switch …admin-setup see the edit
Confirmed since
Anthropic's documentation has since written up permissions.defaultMode, on All settings.
| Read from the highest-priority source only | Reads the key only from the highest-priority source that carries a policy key, so a lower source's value is ignored even when the highest source sets none | [`apiKeyHelper`](#apikeyhelper), [`…settings-reference see the edit
Two sources agreeTwo things we can check say the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up permissions.defaultMode, on All settings.
Anthropic's release notes agree
Fixed sessions dispatched from an agent view opened with ← always starting in the original session's permission mode, overriding the target…