{"version":"2.1.282","anchor":"managed-permission-lists-whose-rules-are-all-invalid-are-now","canonical_anchor":"managed-permission-lists-whose-rules-are-all-invalid-are-now","heading":"Managed deny and ask lists made entirely of broken rules are now flagged","tier":"notice","area":"Managed Settings","url":"https:\/\/changelogs.core-directive.com\/v\/2.1.282\/e\/managed-permission-lists-whose-rules-are-all-invalid-are-now","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.282","markdown":"### Managed deny and ask lists made entirely of broken rules are now flagged\n\nA managed deny or ask list whose rules are all invalid is now marked unreadable rather than quietly treated as empty\n\n**Unclear.** What Claude Code does with a list marked unreadable, beyond warning about it, is not settled.\n\n**What**\n\nIn managed policy, `permissions.deny` and `permissions.ask` are lists of rules for tool use Claude must refuse or ask about. When such a list has rules in it but every one of them is invalid, Claude Code now marks the list as \"unreadable\" instead of quietly treating it as empty. A list where only some rules were invalid is marked \"trimmed\". Both produce a warning. Before, invalid rules were simply skipped, each with its own warning.\n\n**Why**\n\nA deny list that is broken throughout no longer silently turns into \"nothing is denied\" for an organization's policy.\n\n- Area: Managed Settings\n- Names: `permissions.deny`, `permissions.ask`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5"}