Managed policies can be layered instead of first-match only
Managed settings gain policy_mode: layered, which merges several matching policies instead of applying only the first one, with limits to protect deny rules
What probably matters to youSection of the release
What
Managed policies are settings an organization's administrator pushes to Claude Code, each matched to users by group or email domain. Before, only the first matching policy applied. The managed settings now accept an optional policy_mode field with the value "first_match" or "layered":
With layered, the settings of several matching policies are merged into one combined policy. Merged results are kept in a cache of up to 1024 entries.
The matcher now collects matches and stops at the first one that is not layered. If the first two matches are both layered, it returns their combined policy.
Layered mode is refused when a policy uses a helper, a key that limits hooks (hooks are your own commands Claude Code runs at set moments), or a permission rule path starting with "!". The error says the setting "can't be used with policy_mode: layered" and explains that these could drop another matching policy's deny rules.
Why
Administrators can build up settings from several policies, such as one per group, instead of writing one policy that covers everything. The refusals stop a merge from quietly losing a rule that blocks something.
