Deny/ask permission rules that start with a negated Read/Edit pattern are now dropped with a warning
When Claude Code merges deny or ask permission rules from managed settings, or combines always-deny command rules, it now filters out any rule that starts with a negated Read(!...) or Edit(!...) pattern. A warning is logged telling the administrator to write the deny rule without the exception.
This is because a rule starting with ! removes paths from the rules listed before it rather than adding a new restriction, so putting it first in a deny or ask list wouldn't restrict anything as the administrator likely intended.
This stops a misconfigured permission rule from silently doing nothing (or the opposite of what was intended), and instead surfaces a warning so the administrator can fix the rule.