What
allowManagedPermissionRulesOnly is a managed setting. Managed settings are pushed by an organisation's administrators, and this one makes them the only place permission rules can come from. When it is set, the settings now describe an extra condition for plugin marketplaces. A marketplace is a catalogue that plugins are installed from.
- Marketplace source: a marketplace defined in settings keeps its plugins' allowed-tools only when every npm entry pins a
registryon a bare package name. Allowed-tools is the list of tools a plugin may use without asking. - Registry field: an npm marketplace keeps plugin allowed-tools only when the policy entry and the marketplace registration both pin the same registry.
While the setting is on, marketplace sync also downloads the marketplace again every time. It no longer skips the download when the server reports that nothing has changed.
Why
Administrators who rely on npm-sourced plugin marketplaces can lose those plugins' tool grants unless they pin a registry. Check your managed configuration if plugins stop getting the tools they had before.
Names in the bundleallowManagedPermissionRulesOnly
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
The rule is stated in the settings descriptions, and where Claude Code enforces it is not settled.
Anthropic's release notes agree
Fixed plugins from marketplaces, claude.ai and npm pre-approving their own tools via allowed-tools under managed…