Managed policy first populated source wins · no merge
Read top to bottom. The first source holding a value becomes the policy. Nothing below it is read.
1
Remote managed settings
Authored in the admin console, fetched from Anthropic at session start and cached on disk.
macOS~/.claude/remote-settings.json
Windows%USERPROFILE%\.claude\remote-settings.json
cloud‑hosted
2
MDM profile · machine registry
Device-management payload on macOS, machine policy key on Windows.
macOS/Library/Managed Preferences/com.anthropic.claudecode.plist
WindowsHKLM\SOFTWARE\Policies\ClaudeCode
admin‑only
3
File-based managed settings
A JSON file on disk, plus a managed-settings.d/ drop-in folder.
macOS/Library/Application Support/ClaudeCode/managed-settings.json
WindowsC:\Program Files\ClaudeCode\managed-settings.json
Linux/etc/claude-code/managed-settings.json
admin‑only
4
Inherited parent policy
A parentManaged block handed down from an outer managed context.
allparentManaged
5
Per-user registry
Windows only. User-writable, and read only when every source above is empty.
WindowsHKCU\SOFTWARE\Policies\ClaudeCode
user‑writable
policy overrides everything below
User settings deep-merged · later layers refine earlier
Every settings file is read and merged key by key. Nothing short-circuits here.
user
macOS~/.claude/settings.json
Windows%USERPROFILE%\.claude\settings.json
per‑user
project · local
all<project>/.claude/settings.json · settings.local.json
per‑project
Note A policyHelper key replaces this whole resolution with the output of an executable. The key is read only off the source that won above, and honored only when that winner is source 2 or 3 — the locations that require root or admin to write. Declared anywhere else, including source 1, it is ignored as a non-admin source.