{"version":"2.1.284","anchor":"allowmanagedpermissionrulesonly-plugins-keep-allowed-tools","canonical_anchor":"allowmanagedpermissionrulesonly-plugins-keep-allowed-tools","heading":"Managed-rules lockdown keeps plugin tool permissions only from admin-backed sources","tier":"notice","area":"Permissions","url":"https:\/\/changelogs.core-directive.com\/v\/2.1.284\/e\/allowmanagedpermissionrulesonly-plugins-keep-allowed-tools","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.284","markdown":"### Managed-rules lockdown keeps plugin tool permissions only from admin-backed sources\n\nUnder `allowManagedPermissionRulesOnly`, only plugins from admin-backed sources keep their allowed-tools grants; other plugins' grants are ignored\n\n**Unclear.** Only the setting's description changed visibly; the code that enforces it was not seen.\n\n**What**\n\n`allowManagedPermissionRulesOnly` is a managed setting, one an organization's administrators set, that makes managed settings the only source of permission rules. A plugin can declare allowed-tools, a list of tools it may use without asking. The setting's description now says that under this setting a plugin keeps its allowed-tools only if it came through an admin-backed channel:\n\n- plugins loaded with `--plugin-dir` by the host\n\n- the official marketplace from its unpinned Anthropic source\n\n- attested plugins synced from claude.ai\n\n- the organization's claude.ai-hosted marketplaces\n\n- marketplaces declared by managed `extraKnownMarketplaces` or pinned by `strictKnownMarketplaces`\n\n- registry-pinned plugins installed directly from npm\n\nEvery other plugin's allowed-tools are ignored. Before, the description said only plugins picked up from a plugin manifest inside user, project or added skills folders lost theirs.\n\n**Why**\n\nOrganizations using this lockdown may find that plugins from ordinary marketplaces stop getting their tool permissions unless an admin vouches for where they came from.\n\n- Area: Permissions\n- Names: `allowManagedPermissionRulesOnly`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5"}