[BUG] Managed settings file not honored

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

I have a managed setting in /Library/Application Support/ClaudeCode/managed-settings.json denying Read(**/.env). This is not honored. Adding the same exact deny permission to ~/.claude/settings.json successfully denies it.

What Should Happen?

Claude should be blocked from reading the file denied.

Error Messages/Logs

Steps to Reproduce

Create a deny read permission in the file-based managed settings for MacOS and then ask claude to violate the permission by reading a file.

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.91

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

iTerm2

Additional Information

_No response_