You'll notice
Project or local settings can no longer widen the effective permission mode via defaultMode.
The same widening protection now applies to settings.permissions.defaultMode: if a project or local settings file would widen the effective permission mode, that widening is ignored. This is logged via the new tengu_settings_mode_widening_carry_ignored telemetry event.
Names in the bundlepermissions.defaultMode
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up permissions.defaultMode, on All settings.
| Read from the highest-priority source only | Reads the key only from the highest-priority source that carries a policy key, so a lower source's value is ignored even when the highest source sets none | [`apiKeyHelper`](#apikeyhelper), [`…settings-reference see the edit
Two sources agreeTwo things we can check say the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up permissions.defaultMode, on All settings.
Anthropic's release notes agree
Fixed sessions dispatched from an agent view opened with ← always starting in the original session's permission mode, overriding the target…