Skip to content
Patterson Corp

Deployment and open questions

Deployment

Section titled “Deployment”

To install these layers for real, the directory goes alongside managed-settings.json in the platform’s system settings directory (CC-settings § Settings files; CC-admin § Decide how settings reach devices):

Platform System directory Drop-in directory
macOS /Library/Application Support/ClaudeCode/ /Library/Application Support/ClaudeCode/managed-settings.d/
Linux and WSL /etc/claude-code/ /etc/claude-code/managed-settings.d/
Windows C:\Program Files\ClaudeCode\ C:\Program Files\ClaudeCode\managed-settings.d\

Three deployment facts that follow from the cited sources:

  • WSL does not inherit Windows policy by default. “By default, WSL reads only the Linux file path at /etc/claude-code”; extending Windows registry and C:\Program Files\ClaudeCode policy to WSL requires wslInheritsWindowsSettings: true in one of those admin-only Windows sources (CC-admin § Decide how settings reach devices). A developer working in WSL is a different machine as far as these files are concerned.
  • The file-based channel must be the winning managed source. Deploying a policyHelper, a server-managed configuration, or an MDM profile makes the file-based layers invisible — see constraint 1. CC-admin rates the file-based channel “Medium” tamper-resistance and applicable to all users.
  • Verify after deploying. /status shows a Setting sources line naming each loaded layer with its delivery channel in parentheses, for example Enterprise managed settings (file); a source appears “only when that source is loaded with at least one key” (CC-settings § Verify active settings). It confirms which sources loaded, not which layer supplied each key.

Open questions

Section titled “Open questions”

Each of these is a question the cited sources do not answer. None of them is guessed at above.

# Question Marker
1 Does an extraKnownMarketplaces entry carrying only a changed scalar, with no source, pass per-file validation before the drop-in merge runs? [TBD: not specified in CC-settings]
2 Which Claude Code version introduced managed-settings.d/? Other managed-settings behaviours carry explicit minimums; the drop-in directory does not. [TBD: not specified in CC-settings]
3 How does a given machine receive only its own sub-org, department, and team fragments? The drop-in directory describes merging, not targeting or distribution. [TBD: not specified in CC-admin]
4 Does concatenating permissions.deny across fragments behave as the general array rule implies for a deny-direction array? [TBD: not specified in CC-settings]
5 Does VS Code offer any drop-in or layering mechanism for org tiers, or only single-valued policies? [TBD: not specified in VSC-enterprise]
6 Can Copilot layer more than one organization-level instruction set, for example per sub-org? [TBD: not specified in GHC-org-instructions]
7 What plugins will patterson-dental, patterson-vet, and patterson-labs publish? The catalogs are named in this repository’s README; their contents are undefined. [TBD: no source]
8 Does Patterson’s Approved Software process cover managed settings deployed by IT to developer machines? [TBD: no source]

Citations

Section titled “Citations”

Every settings key written into managed-settings.d/, with its source:

Key Source
$schema CC-settings § Settings files — “The $schema line in the example above points to the official JSON schema for Claude Code settings”
extraKnownMarketplaces CC-settings § extraKnownMarketplaces; CC-marketplaces § Require marketplaces for your team, § Managed marketplace restrictions
extraKnownMarketplaces.<name>.source CC-settings § extraKnownMarketplaces, “Marketplace source types”
extraKnownMarketplaces.<name>.source.source: "github" CC-settings § extraKnownMarketplaces — “github: GitHub repository (uses repo)”
extraKnownMarketplaces.<name>.source.repo CC-settings § extraKnownMarketplaces; § strictKnownMarketplaces (“Owner wildcards”) for the single-repository constraint
extraKnownMarketplaces.<name>.autoUpdate CC-settings § extraKnownMarketplaces — “Each marketplace entry also accepts an optional autoUpdate Boolean”
enabledPlugins CC-settings § enabledPlugins — format "plugin-name@marketplace-name": true/false

Keys cited but deliberately not written, appearing only as commented-out switches: strictKnownMarketplaces (CC-settings § strictKnownMarketplaces), blockedMarketplaces and disableSideloadFlags (CC-settings § Available settings), permissions.deny (CC-settings § Settings files), forceLoginMethod and forceLoginOrgUUID (CC-settings § Available settings; CC-admin § Decide what to enforce), and a managed enabledPlugins false (CC-settings § enabledPlugins).

Full source paths, relative to /workspaces/code/github.com/patterson-agents/:

Shorthand Path
CC-settings .tmp/staging/docs/claude-code/settings.md
CC-marketplaces .tmp/staging/docs/claude-code/plugin-marketplaces.md
CC-admin .tmp/staging/docs/claude-code/admin-setup.md
CC-server .tmp/staging/docs/claude-code/server-managed-settings.md
VSC-enterprise .tmp/staging/docs/vscode/enterprise-ai-settings.md
VSC-plugins-norm patterson-platform-docs/references/platforms/vscode/_NORMATIVE-agent-plugins.md
VSC-harness-norm patterson-platform-docs/references/platforms/vscode/_NORMATIVE-agent-harnesses.md
GHC-precedence .tmp/staging/docs/copilot/response-customization-precedence.md
GHC-support .tmp/staging/docs/copilot/custom-instructions-support-matrix.md
GHC-cascade .tmp/staging/docs/copilot/policies-concepts-cascade.md
GHC-org-instructions .tmp/staging/docs/copilot/org-custom-instructions.md

The .tmp/staging/docs/ tree is a snapshot fetched 2026-08-11, not a live vendor feed. Every claim above is re-verifiable against these paths rather than re-derivable from memory; when vendor behaviour changes, re-fetch and re-check rather than reasoning forward from this document.

Section titled “Related”

Source of truth: docs/architecture/layered-settings.md in the patterson-corp repository.