What
In managed.policies, an entry with match: {} is the catch-all base that other entries are merged with. deniedModels, the list of models that are not allowed, is now combined when that merge happens: the base list and an entry's own list are joined and duplicates removed. Before, an entry that set its own deniedModels replaced the base list entirely.
This is how disabledMcpjsonServers, deniedMcpServers and blockedMarketplaces were already merged.
Why
An admin who denies a model in the catch-all policy can no longer have that silently undone by a more specific policy that sets its own deniedModels.
Names in the bundlemanaged.policiesdeniedModels
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
Which program or command runs this policy merge is not confirmed.
Anthropic's release notes agree
Added deniedModels managed setting to block specific models, even when availableModels allows them
The name it cites is new in this build
New in this build: deniedModels