Use it now
No documentation found
A new managed-settings-only flag lets organizations put their bundled sec-default plugin ahead of user-installed plugin hooks
What
A new settings field, honored only when set in managed settings (not user, project, local, or --settings), controls whether the organization's bundled "sec-default" plugin takes the outermost seat in the chain of plugin hooks, ahead of any plugins listed in prependPlugins.
Why
This keeps things like classic hooks, prompt content, managed settings, and tool policy protected from being overridden by plugins that users install themselves, since only an administrator setting managed settings can control this placement.
Names in the bundlesecDefault
One source agreesOne thing we can check says the same as this entry.
The name it cites is new in this build
New in this build: secDefault