You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
PermissionsArea: what it touches
Bug FixesKind: in v2.1.269,
Bug FixesSection of the release
What
When Claude Code applies managed settings inherited from a parent process, deny or ask permission rules written like Read(...! or Edit(...! (an exception-style negation) are now filtered out, and a warning is logged explaining why. These rules only work to strip paths from earlier rules in a list, so when merged directly into policy they don't restrict anything.
Why
Without this change, such a rule could look like it was denying or restricting something when it actually had no effect once merged, creating a false sense of restriction. The warning tells users to write the deny rule without the exception syntax instead.
