What probably matters to youSection of the release
Unclear How policyOnlyLeads gets set in a managed policy is not stated.
What
Managed settings are settings an administrator applies to Claude Code, and they can come from several admin sources. How these sources are combined has changed.
The merging code gains a server tier handled as "policy only" (policyOnlyServerTier). When that server tier is "unconfirmed", it is treated as held, and the merge returns a policyOnlyLeads result. Some keys are merged from the kept slot into the admin tier.
Setting CLAUDE_CODE_DISABLE_ADMIN_ENV_UNION normally makes Claude Code use only the highest-priority source's env block instead of merging env blocks across admin sources. It now does that only when policyOnlyLeads is not set. When policyOnlyLeads is set, the env blocks from all admin sources are still merged even with the variable set.
Why
If you rely on CLAUDE_CODE_DISABLE_ADMIN_ENV_UNION to stop admin env blocks from merging, it may no longer take effect when this policy state applies. Admins should check which environment values actually reach Claude Code.
