Unclear Which program or command runs this policy merge is not confirmed.
In managed.policies, an entry with match: {} is the catch-all base that other entries are merged with. deniedModels, the list of models that are not allowed, is now combined when that merge happens: the base list and an entry's own list are joined and duplicates removed. Before, an entry that set its own deniedModels replaced the base list entirely.
This is how disabledMcpjsonServers, deniedMcpServers and blockedMarketplaces were already merged.
An admin who denies a model in the catch-all policy can no longer have that silently undone by a more specific policy that sets its own deniedModels.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
| Lists | Combines the entries from every source | `permissions.allow`, `hooks`, `sandbox.network.allowedDomains`, `deniedMcpServers`, `deniedModels` |managed-settings see the edit
| `google_groups` | No | Look up the signed-in user's groups through the Google Workspace Admin SDK Directory API, because Google's id\_token carries no groups claim. Set `service_account_json_path` to a service-account key file with domai…claude-apps-gateway-config see the edit
Which program or command runs this policy merge is not confirmed.
Anthropic's documentation has since written up managed.policies, on Claude apps gateway configuration.
Added deniedModels managed setting to block specific models, even when availableModels allows them
New in this build: deniedModels