[DOCS] `allowManagedHooksOnly` docs incorrectly say all plugin hooks are blocked

Documentation Type

Incorrect/outdated documentation

Documentation Location

https://code.claude.com/docs/en/settings

Section/Topic

Hook loading behavior when allowManagedHooksOnly is enabled and plugins are force-enabled by managed settings

Current Documentation

The settings page currently defines allowManagedHooksOnly as:

allowManagedHooksOnly — (Managed settings only) Prevent loading of user, project, and plugin hooks. Only allows managed hooks and SDK hooks.

It also lists this behavior:

Behavior when allowManagedHooksOnly is true: Managed hooks and SDK hooks are loaded User hooks, project hooks, and plugin hooks are blocked

The hooks page repeats the same rule:

Enterprise administrators can use allowManagedHooksOnly to block user, project, and plugin hooks.

At the same time, the plugins page already documents that marketplace plugins force-enabled by managed settings are a special managed case:

Marketplace plugins force-enabled by managed settings are the only exception and cannot be overridden.

What's Wrong or Missing?

Claude Code v2.1.101 changed allowManagedHooksOnly so plugin hooks from plugins force-enabled by managed settings still run.

The current docs are now incorrect because they say plugin hooks are categorically blocked. That misses the managed-plugin exception and makes it unclear which hooks enterprise admins should expect to execute.

This is especially confusing for organizations that use managed settings to force-enable approved plugins:

• the settings and hooks docs imply those plugin hooks will never run
• the plugins docs already describe force-enabled plugins as a managed exception
• there is no single place that explains how these rules combine

Suggested Improvement

Update the settings and hooks docs to clarify the exception, for example:

• user hooks and project hooks are blocked
• ordinary user-enabled plugins are blocked
• plugin hooks from plugins force-enabled by managed settings still run because they are part of the managed configuration

A short matrix or example would help administrators understand which hook sources remain active when allowManagedHooksOnly is true.

Impact

Medium - Makes feature difficult to understand

Additional Context

Affected Pages:
| Page | Context |
|------|---------|
| https://code.claude.com/docs/en/settings | allowManagedHooksOnly definition and hook behavior list currently say plugin hooks are blocked |
| https://code.claude.com/docs/en/hooks | Repeats that allowManagedHooksOnly blocks plugin hooks |
| https://code.claude.com/docs/en/plugins | Already documents force-enabled marketplace plugins as a managed-settings exception |

Total scope: 3 pages affected

Source: Claude Code v2.1.101 release notes

Improved plugin hooks from plugins force-enabled by managed settings to run when allowManagedHooksOnly is set