Managed settings

For organizations that need centralized control, administrators deploy managed settings that user and project settings can't override, apart from a few security-sensitive keys. Deploy managed settings covers the delivery mechanisms, precedence within the managed tier, and the keys that only managed settings can set.

One of those keys, allowManagedPermissionRulesOnly, makes managed settings the only settings source of permission rules. Its entry lists every source Claude Code then ignores.

disableBypassPermissionsMode is typically placed in managed settings to enforce organizational policy, but it works from any scope. A user can set it in their own settings to lock themselves out of bypass mode.