You'll notice
Managed-settings deny/ask rules starting with '!' are now dropped with a warning instead of applied
What
When Claude Code applies managed settings inherited from a parent process, deny or ask permission rules written like Read(...! or Edit(...! (an exception-style negation) are now filtered out, and a warning is logged explaining why. These rules only work to strip paths from earlier rules in a list, so when merged directly into policy they don't restrict anything.
Why
Without this change, such a rule could look like it was denying or restricting something when it actually had no effect once merged, creating a false sense of restriction. The warning tells users to write the deny rule without the exception syntax instead.