Policies
Governance the client enforces regardless of what the model decides. This is the hard counterpart to conventions — and the thing people most often confuse with them.
Analogy — conventions are the employee handbook; policies are the building’s keycard system and the firewall. The handbook asks; the keycard enforces. You don’t secure a server room with a memo.
Two layers, both hard
Permission rules
Declarative allow / ask / deny patterns in settings.json.
Evaluated deny → ask → allow, first match wins. Config, not code — that’s what separates them
from hooks.
"permissions": {
"deny": ["Read(./.env)", "Bash(curl *)"],
"ask": ["Bash(git push *)"],
"allow": ["Bash(npm run test*)"],
"defaultMode": "acceptEdits"
}
Managed settings (the enterprise policy layer)
Admin-deployed managed-settings.json at the highest precedence — cannot be
overridden by user, project, or local settings. Permission rule arrays merge across scopes; most other
keys override by priority.
Locations & managed-only keys
macOS /Library/Application Support/ClaudeCode/managed-settings.json ·
Linux/WSL /etc/claude-code/managed-settings.json ·
Windows C:\Program Files\ClaudeCode\managed-settings.json or HKLM\SOFTWARE\Policies\ClaudeCode.
Managed-only keys: allowManagedPermissionRulesOnly, allowManagedHooksOnly,
allowManagedMcpServersOnly, forceLoginOrgUUID, availableModels,
allowedMcpServers/deniedMcpServers, claudeMd, sandbox.enabled,
disableWorkflows.
claudeMd key injects behavioral guidance org-wide — but it’s still soft guidance
shipped through the hard layer. Managed settings (deny rules, sandbox) are the technical enforcement.
Same delivery, different nature.When to reach for it
allow) or force a prompt on risky ones (ask).When not to
Best practices
deny secrets and destructive commands first; deny always wins.availableModels + model + ANTHROPIC_DEFAULT_*_MODEL (the model setting alone is only the initial selection, not enforcement).allowManagedPermissionRulesOnly to stop users adding their own allowlist entries.