{"version":"2.1.307","anchor":"policyonlyleads-now-disables-the-admin-env-union-opt-out","canonical_anchor":"policyonlyleads-now-disables-the-admin-env-union-opt-out","heading":"Managed settings: policyOnlyLeads changes how admin env blocks are merged","tier":"use","area":"Managed Settings","scope":"org","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.307\/e\/policyonlyleads-now-disables-the-admin-env-union-opt-out","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.307","markdown":"### Managed settings: policyOnlyLeads changes how admin env blocks are merged\n\nA new policyOnlyLeads result in managed settings merging can override CLAUDE_CODE_DISABLE_ADMIN_ENV_UNION and keep admin env blocks merged\n\n**Unclear.** How `policyOnlyLeads` gets set in a managed policy is not stated.\n\n**What**\n\nManaged settings are settings an administrator applies to Claude Code, and they can come from several admin sources. How these sources are combined has changed.\n\n- The merging code gains a server tier handled as \"policy only\" (`policyOnlyServerTier`). When that server tier is \"unconfirmed\", it is treated as held, and the merge returns a `policyOnlyLeads` result. Some keys are merged from the kept slot into the admin tier.\n\n- Setting `CLAUDE_CODE_DISABLE_ADMIN_ENV_UNION` normally makes Claude Code use only the highest-priority source's `env` block instead of merging `env` blocks across admin sources. It now does that only when `policyOnlyLeads` is not set. When `policyOnlyLeads` is set, the `env` blocks from all admin sources are still merged even with the variable set.\n\n**Why**\n\nIf you rely on `CLAUDE_CODE_DISABLE_ADMIN_ENV_UNION` to stop admin `env` blocks from merging, it may no longer take effect when this policy state applies. Admins should check which environment values actually reach Claude Code.\n\n- Area: Managed Settings\n- Names: `CLAUDE_CODE_DISABLE_ADMIN_ENV_UNION`\n- Tier: Use it now\n- Useful: 3\/5\n- Signal: 3\/5\n- Scope: org\n- Heads-up: no"}