{"version":"2.1.315","anchor":"managed-policies-gain-policy-mode-layered","canonical_anchor":"managed-policies-gain-policy-mode-layered","heading":"Managed policies can be layered instead of first-match only","tier":"use","area":"Managed Settings","scope":"org","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.315\/e\/managed-policies-gain-policy-mode-layered","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.315","markdown":"### Managed policies can be layered instead of first-match only\n\nManaged settings gain `policy_mode: layered`, which merges several matching policies instead of applying only the first one, with limits to protect deny rules\n\n**What**\n\nManaged policies are settings an organization's administrator pushes to Claude Code, each matched to users by group or email domain. Before, only the first matching policy applied. The managed settings now accept an optional `policy_mode` field with the value \"first_match\" or \"layered\":\n\n- With `layered`, the settings of several matching policies are merged into one combined policy. Merged results are kept in a cache of up to 1024 entries.\n\n- The matcher now collects matches and stops at the first one that is not layered. If the first two matches are both layered, it returns their combined policy.\n\n- Layered mode is refused when a policy uses a helper, a key that limits hooks (hooks are your own commands Claude Code runs at set moments), or a permission rule path starting with \"!\". The error says the setting \"can't be used with policy_mode: layered\" and explains that these could drop another matching policy's deny rules.\n\n**Why**\n\nAdministrators can build up settings from several policies, such as one per group, instead of writing one policy that covers everything. The refusals stop a merge from quietly losing a rule that blocks something.\n\n- Area: Managed Settings\n- Tier: Use it now\n- Useful: 5\/5\n- Signal: 3\/5\n- Scope: org\n- Heads-up: yes"}