The fixed set of paths always treated as reach-relevant during session sandbox/settings scans now includes two additional policy-limits.json locations, returned by helper functions, alongside the existing set of scheduled_tasks.json, launch.json, CLAUDE.md, daemon.json, and policy-limits.json.
Names in the bundlepolicy-limits.json
Documented inclaude-code/claude-directory
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up policy-limits.json, on Explore the .claude directory.
| `~/.claude/policy-limits.json` | Nothing. Refreshed automatically. |claude-directory see the edit
Added since
A small documentation edit on Explore the .claude directory touched a line naming policy-limits.json after this was published.
| `policy-limits.json` | Cached feature policy settings for your organization. Only present for some account types. Refreshed automatically. A `policy-limits.json.stamp.json` sidecar records which account or API key the cache belongs to. C…claude-directory see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
A small documentation edit on Explore the .claude directory touched a line naming policy-limits.json after this was published.