{"version":"2.1.273","anchor":"new-managed-only-settings-key-isolation","canonical_anchor":"new-sandbox-isolation-restrictions-isolationrequired-iso","heading":"Sandbox settings gain a dedicated 'isolation' category","tier":"use","area":"Settings","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.273\/e\/new-managed-only-settings-key-isolation","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.273","markdown":"### Sandbox settings gain a dedicated 'isolation' category\n\nSettings diffs, approval prompts, and managed-settings validation now treat sandbox isolation as its own tracked category\n\n**What**\n\nClaude Code's sandbox configuration can restrict what a session is allowed to do, and settings changes made by an organization admin can be shown to the user for approval before they take effect. This release gives sandbox isolation its own tracked category throughout that machinery:\n\n- The settings-diff and permission-approval summary code now tracks `isolationSettings`\/`isolationRows` as its own bucket, alongside the existing shell, environment variable, and sandbox settings buckets, both in the diff view and in prompts like \"3 sandbox settings x3\".\n\n- Settings validation now treats `isolation` the same way it already treated `managedMcpServers`: if it appears outside of managed (admin-controlled) settings, it's stripped out with a warning that it's \"only honored from managed settings and was ignored here.\"\n\n- Two new restriction-policy entries were added: `isolation.required` and `isolation.persistHome`, plus a new VM-isolation-specific warning message.\n\n- The managed-settings approval dialog now reads an `isolation` block with `required`\/`egress` keys and shows an elided isolation count alongside existing elided command\/sandbox counts.\n\n**Why**\n\nThis makes sandbox isolation settings visible and auditable in the same way other managed settings already were, so admins and users can see when isolation-related policy is being changed, enforced only from managed settings, or partially hidden (elided) in an approval prompt.\n\n- Area: Settings\n- Names: `isolation`\n- Tier: Use it now\n- Useful: 4\/5\n- Signal: 2\/5"}