{"version":"2.1.300","anchor":"managed-settings-signature-verification-anchored-claims","canonical_anchor":"managed-settings-signature-verification-anchored-claims","heading":"Managed-settings token checks gain unanchoredClaims, with more restricted-mode changes","tier":"use","area":"Managed Settings","scope":"org","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.300\/e\/managed-settings-signature-verification-anchored-claims","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.300","markdown":"### Managed-settings token checks gain unanchoredClaims, with more restricted-mode changes\n\nSigned managed-settings checks gain an `unanchoredClaims` option and return org and account IDs, alongside more restricted-mode handling changes\n\n**What**\n\nManaged settings are settings an organization deploys to control Claude Code. They can arrive as a signed token, a piece of data whose signature proves where it came from. How that token is checked, and some related handling, has changed:\n\n- The check now takes an `unanchoredClaims` option. Its \"claims\" are statements inside the token, such as who it is meant for (`aud`) and who it is about (`sub`). These two are now compared only when expected values are supplied, or when `unanchoredClaims` is set to \"refuse\". Before, they were always compared.\n\n- One check that runs while managed settings are being handled now passes `unanchoredClaims: \"refuse\"`.\n\n- The check now also returns the token's `organizationUuid` and `accountUuid`.\n\n- In a particular restricted mode, managed-settings handling now keeps `claudeMd` from the verified settings. `claudeMd` is the setting that adds organization-wide CLAUDE.md instructions.\n\n- In the same mode, the decision log for auto mode now stops early, before it checks `AUTOMODE_DECISION_LOG`.\n\n**Why**\n\nThis changes how strictly the signed managed-settings token is checked. When \"refuse\" is used, a token that does not name the expected audience and subject is no longer accepted without question. Organizations deploying managed settings, including organization-wide CLAUDE.md instructions, may see different behaviour in the restricted mode.\n\n- Area: Managed Settings\n- Names: `unanchoredClaims`\n- Tier: Use it now\n- Useful: 4\/5\n- Signal: 3\/5\n- Scope: org\n- Heads-up: no"}