When merging managed settings from multiple sources, policy-helper configuration from lower-priority sources is now ignored with a warning
When managedSourcesBehavior is set to "merge" (composing every managed settings source, such as MDM or a managed settings file, instead of only using the highest-priority one), policy-helper configuration keys found in a non-highest-priority source are now explicitly ignored, and Claude Code surfaces a warning about it. Previously this configuration would silently merge in.
Policy helper configuration is now read only from the highest-priority managed settings source. The warning makes this explicit instead of letting an admin believe a lower-priority source's helper settings were taking effect when they weren't.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
* **Gateway sign-in keys**: Claude Code never reads [`forceLoginGatewayUrl`](/docs/en/settings-reference#forcelogingatewayurl), [`gatewayInternalNetworks`](/docs/en/settings-reference#gatewayinternalnetworks), or the `"gateway"` value of […server-managed-settings see the edit
The hooks lock and `allowManagedPermissionRulesOnly`'s effect on the developer's own rules need the winning source by default; under the `managedSourcesBehavior` merge opt-in in [how Claude Code combines managed sources](/docs/en/managed-s…claude-apps-gateway see the edit
Anthropic's documentation has since written up managedSourcesBehavior, on Claude apps gateway for Amazon Bedrock, Claude Platform on AWS…