Silent Managed Settings and Verification in Claude Code 2.1.316

0:00 Picture this. You open a terminal on a Monday, start Claude Code, and your platform team has quietly added a hook overnight. Used to be you'd see a dialog about it first. Not anymore. This is The Claude Code Changelog, brought to you by Jellypod AI. I'm Lachlan, and James is here to walk through what changed.

0:24 Last time we covered the subagent effort variable and the external file write blocking in 2.1.316. Today is the admin and security side of that same release, and it comes down to one line in the notes, released October 31.

0:39Quote "Changed server managed settings for Team and Enterprise logins: settings

0:44 fetched from Anthropic's API now apply without an approval prompt, and a stored copy that doesn't verify is refused." That's it. One line, and it changes what you see at startup. So let's rewind to how it worked. An owner sets policy in the claude.ai admin console, and Claude Code fetches it at startup and polls for updates hourly.

1:06 Most of that policy never needed your sign off. The dialog covered the risky subset. Settings that run shell commands, like apiKeyHelper, statusLine and otelHeadersHelper. Sandbox settings that point at an executable or weaken isolation, such as sandbox.filesystem.disabled. Delivered env variables, like proxy and base URL ones.

1:33 And any hook definition. Per the docs, the wording was "Users must approve to proceed." Now, be fair to the old dialog. It was never a veto. The docs say if you rejected the settings, Claude Code exits. And in non interactive runs, like print mode or the Agent SDK, there was no way to show it, so those settings already applied for that run.

1:55 So what you lose is the notice. The moment where a new hook got named on screen before it ran. That part is fact. Whether that's a good trade is interpretation, and it depends on whether your team read that dialog or just mashed Enter. The other half is a hardening. The docs describe a case where someone edits the cached settings file, and the tampered file applies at startup until the next server fetch restores it.

2:20 A stored copy that doesn't verify is refused reads like the fix for that. But the release notes don't say how the copy is verified, so I'd not assume more than that.

2:30One practical wrinkle if you're offline and your cached copy fails verification,

2:35 Claude Code refuses it. Expect that, rather than being surprised by it. So if you're on a Team or Enterprise login, here's how to look for yourself. First, update, then run claude doctor. Find the line that says Managed settings, remote. The docs say it reports whether the delivered settings loaded, whether your org has none, or why the fetch failed.

2:57 That needs version 2.1.248 or later. Inside a session, slash status shows which managed source is active, and slash permissions shows your effective permission rules. Then read the cached payload. It lives at remote settings dot json inside your dot claude folder in your home directory. Run jq on it, and look for hooks, apiKeyHelper, statusLine, otelHeadersHelper, anything under sandbox, and the env block.

3:24 Those are exactly the keys the dialog used to put in front of you. And don't try to build your own tripwire with a ConfigChange hook. The docs say those don't run when server managed settings arrive or refresh. If you're the admin, flip it around. Your developers get no on screen notice when you add a hook, so tell them in Slack or wherever they actually read.

3:49 Audit log events for settings changes are available through the compliance API or audit log export. Also, the docs still call server managed settings a client side control, not a security boundary. That hasn't changed.

4:05One more thing at the time of writing, the docs page still described the old

4:09 dialog, so don't be thrown if it disagrees with your terminal. A few smaller things in 2.1.316. Shell commands are no longer left running on macOS and Linux when Claude Code exits by itself, say when credentials are refused or a cloud session is archived. Sessions started with the restricted flag could upload files from outside the working directories when a Read allow rule covered them.

4:33 That's fixed, so update if you rely on it. For gateway folks, there's pooled budget on the spend limits admin API, one shared monthly budget for a group on top of each member's own limit. Managed policy mode layered merges every matching policy instead of stopping at the first. Guardrail input tagging for Bedrock upstreams wraps prompts in the tags a guardrail's prompt attacks filter needs.

5:00 And in VS Code, you can sign in to a Claude apps gateway right from the chat panel. So, today's homework: run claude doctor, and read that cached file once. Five minutes, and you'll know exactly what your org runs on your machine.