What
In Cowork cloud, Claude Code now holds on to certain managed policy settings once they have been applied. A later settings update cannot loosen them. The held settings are:
allowManagedHooksOnly, which runs only the hooks your organization deploysdisableAllHooks, which turns off hooks, a custom status line and a custom@file suggestion commanddisableCommandPluginSources, which blocks plugins that install by running a commandallowManagedModsOnly, a plugin option
The held values are combined back in with the incoming settings, with managedSourcesBehavior set to merge.
Why
Once an organization tightens one of these policies in Cowork cloud, a later refresh of the settings cannot quietly undo it.