configuration-meta

Configure tool permissions in your settings using allow, ask, and deny rules to control which Bash commands and file operations Claude can execute. Sandbox settings enforce security policies at the user, project, or enterprise level depending on your configuration layer.

Configuration precedence flows from enterprise managed-settings.json (highest) through project settings.json to user settings.json (lowest). Enterprise policies override project and user settings, while project settings override user defaults, enabling layered governance.

Use managed-settings.json at the enterprise level to restrict Bash commands, auto-approve file operations, and enforce sandbox rules across all users. This prevents policy bypass and ensures consistent security posture without individual configuration.

Yes, configure environment variables through settings files and marketplace plugins via configuration keywords. Environment variable precedence follows the same hierarchy as settings, allowing local overrides of system defaults.

Check the configuration precedence order: enterprise managed-settings.json overrides project and user settings. Verify your rule syntax matches allow, ask, or deny format, and confirm the setting layer you edited has no conflicting rules higher in the hierarchy.

Understanding precedence prevents configuration conflicts and accidental policy bypass. Learn the hierarchy—enterprise, project, user, and environment variables—to predict which rules take effect and troubleshoot unexpected behavior efficiently.