Scope and Precedence
Claude Code uses four settings scopes, applied from highest to lowest priority:
| Priority | Scope | Location | Shared? | Purpose |
|---|---|---|---|---|
| 1 | Managed | Server, MDM profile, registry, or system managed-settings.json | Yes (IT-deployed) | Org-wide policies, cannot be overridden |
| 2 | Command line | -- flags at startup | No | Temporary session overrides |
| 3 | Local | .claude/settings.local.json | No (gitignored) | Personal project-specific |
| 4 | Project | .claude/settings.json | Yes (committed) | Team-shared settings |
| 5 | User | ~/.claude/settings.json | No | Global personal defaults |
Array merging: Settings like permissions.allow, sandbox.filesystem.allowWrite, and allowedHttpHookUrls are concatenated and deduplicated across scopes, not replaced.
Deny precedence: permissions.deny rules always take effect regardless of allow/ask rules at any scope.
Managed settings delivery methods:
- Server-managed (Claude.ai admin console)
- macOS MDM:
com.anthropic.claudecodeplist - Windows registry:
HKLM\SOFTWARE\Policies\ClaudeCode - File:
managed-settings.jsonat/Library/Application Support/ClaudeCode/(macOS),/etc/claude-code/(Linux/WSL),C:\Program Files\ClaudeCode\(Windows) - Drop-in directory:
managed-settings.d/*.jsonalongsidemanaged-settings.json, merged alphabetically
Other config: ~/.claude.json stores OAuth session, MCP server configs, per-project trust state, and preferences like editorMode. Do not put ~/.claude.json keys into settings.json: it will trigger schema validation errors.