[BUG] Claude Desktop 3P Chat: builtinToolPolicy.Bash=allow does not pre-approve advanced file analysis (mcp__workspace__bash)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Summary

On Claude Desktop for third-party (Amazon Bedrock + bootstrap managed config), Chat advanced file analysis still prompts Allow once / Deny for every sandbox shell call, even when builtinToolPolicy.Bash is "allow" and the client has clearly received that policy.

Cowork with the same policy does not prompt. Chat does.

We first reported this to the AWS Solutions Library guidance repo (aws-solutions-library-samples/guidance-for-claude-code-with-amazon-bedrock#807). AWS confirmed the bootstrap/config delivery path is working and that this is a Claude Desktop client policy-resolution issue, and guided us to escalate here / to Anthropic enterprise support.

Environment

• Product: Claude Desktop on 3P (Bedrock SSO)
• App version: 1.24012.9 (macOS)
• Config delivery: Bootstrap URL → org-managed config (SSM-backed)
• Surfaces: Chat enabled; Code disabled; Cowork tested on/off
• Inference: Amazon Bedrock (e.g. Claude Opus via Bedrock)

Expected (per Anthropic docs)

From Chat tab and Configuration / builtinToolPolicy:

1. chatAdvancedFileAnalysisEnabled enables sandbox code execution for attachments.
2. Advanced file analysis uses the same shell tool as Cowork’s sandbox; "Bash" in disabledBuiltinTools disables it.
3. disabledBuiltinTools and builtinToolPolicy “apply in Chat the same way they do in the other tabs.”
4. "ask" requires approval each call; "allow" is the default (pre-approved).
5. Chat always runs in default permission mode (Auto mode is rejected for Chat).

With:

"builtinToolPolicy": { "Bash": "allow" }

Chat sandbox bash should run without per-call prompts.

Actual

1. In Chat, attach a file and ask to summarize/analyze it.
2. UI shows “Claude wants to use bash” with Allow once / Deny for each command (e.g. ls ../uploads/).
3. No “Always allow” on that prompt.
4. Same managed config → Cowork sandbox bash runs with no prompts.
5. In-app config shows Built-in tool policy Bash = allow (source: bootstrap URL).

Evidence

Local session audit:

tool_name: "mcp__workspace__bash"
tool_use_meta: { "display_name": "Bash", "server_display_name": "workspace" }
subtype: "permission_request" → decision: "once"

Session tools include mcp__workspace__bash (dynamic workspace MCP), not a top-level builtin Bash tool.

Device bootstrap cache retained:

"builtinToolPolicy": { "Bash": "allow" }

…and dropped "mcp__workspace__bash" when placed under builtinToolPolicy (only Bash appears in the Built-in tool policy UI).

Configurations tried (all via bootstrap)

1. Documented approach — still prompts in Chat

{
  "chatTabEnabled": true,
  "chatAdvancedFileAnalysisEnabled": true,
  "coworkTabEnabled": false,
  "isClaudeCodeForDesktopEnabled": false,
  "autoModeEnabled": false,
  "builtinToolPolicy": {
    "Bash": "allow"
  }
}

2. FQDN in builtinToolPolicy — client ignores / strips

"builtinToolPolicy": {
  "Bash": "allow",
  "mcp__workspace__bash": "allow"
}

3. managedMcpServers targeting workspace — no effect on Chat prompts

"managedMcpServers": [
  {
    "name": "workspace",
    "toolPolicy": {
      "bash": "allow",
      "mcp__workspace__bash": "allow"
    }
  }
]

workspace appears to be a session-dynamic built-in MCP server, not an admin-provisioned connector.

4. Cowork control

• coworkTabEnabled: true + Bash: allow → no bash prompts in Cowork
• Chat with the same policy → still prompts

AWS confirmation (prior escalation)

From guidance-for-claude-code-with-amazon-bedrock#807 (comment) (@wirjo):

Chat's advanced file analysis uses mcp__workspace__bash (a session-dynamic MCP server tool), but builtinToolPolicy.Bash = "allow" only resolves to the top-level built-in tool. The client correctly maps disabledBuiltinTools: ["Bash"] to block mcp__workspace__bash, but doesn't apply builtinToolPolicy.Bash = "allow" to pre-approve it in Chat mode — an asymmetry in the client's policy resolution. The bootstrap config is delivered correctly… The disconnect is downstream in Claude Desktop's internal mapping. Recommended next step: File this with Anthropic's enterprise support or on anthropics/claude-code.

Issue closed as out-of-scope for the AWS guidance repo.

Questions

1. Is builtinToolPolicy.Bash = "allow" supposed to pre-approve Chat advanced file analysis (mcp__workspace__bash)? Docs imply yes; runtime says no.
2. If Chat intentionally always asks for sandbox bash, can the docs be updated, and is there any admin key to pre-approve it in 3P?
3. Is there a supported way to set policy on the dynamic workspace server for Chat?
4. Why does disabledBuiltinTools: ["Bash"] map to this tool, but builtinToolPolicy.Bash = "allow" does not apply in Chat?

Ask

Please confirm intended behavior and the supported admin configuration (if any) to pre-approve Chat sandbox bash / advanced file analysis without per-command Allow once prompts in Claude Desktop on 3P (Bedrock + bootstrap).

References

• https://claude.com/docs/third-party/claude-desktop/chat
• https://claude.com/docs/third-party/claude-desktop/configuration#builtintoolpolicy
• https://claude.com/docs/third-party/claude-desktop/configuration#chatadvancedfileanalysisenabled
• https://claude.com/docs/third-party/claude-desktop/code
• Prior AWS thread: https://github.com/aws-solutions-library-samples/guidance-for-claude-code-with-amazon-bedrock/issues/807

What Should Happen?

Expected (per Anthropic docs)

From Chat tab and Configuration / builtinToolPolicy:

1. chatAdvancedFileAnalysisEnabled enables sandbox code execution for attachments.
2. Advanced file analysis uses the same shell tool as Cowork’s sandbox; "Bash" in disabledBuiltinTools disables it.
3. disabledBuiltinTools and builtinToolPolicy “apply in Chat the same way they do in the other tabs.”
4. "ask" requires approval each call; "allow" is the default (pre-approved).
5. Chat always runs in default permission mode (Auto mode is rejected for Chat).

With:

"builtinToolPolicy": { "Bash": "allow" }

Chat sandbox bash should run without per-call prompts.

Error Messages/Logs

**Error Messages / Logs**

No crash or API error — the failure mode is a repeated permission prompt. Relevant Chat session audit lines (`audit.jsonl`):


{
  "type": "assistant",
  "message": {
    "content": [
      {
        "type": "tool_use",
        "name": "mcp__workspace__bash",
        "input": { "command": "ls ../uploads/" }
      }
    ]
  },
  "tool_use_meta": [
    {
      "display_name": "Bash",
      "server_display_name": "workspace"
    }
  ]
}



{
  "type": "system",
  "subtype": "permission_request",
  "tool_name": "mcp__workspace__bash",
  "tool_input": { "command": "ls ../uploads/" }
}



{
  "type": "system",
  "subtype": "permission_response",
  "tool_name": "mcp__workspace__bash",
  "decision": "once",
  "granted": true
}


Session init also lists the tool as MCP-qualified (not builtin `Bash`):


{
  "type": "system",
  "subtype": "init",
  "tools": [
    "AskUserQuestion",
    "Edit",
    "Read",
    "Write",
    "mcp__workspace__bash",
    "mcp__workspace__web_fetch"
  ],
  "mcp_servers": [
    { "name": "workspace", "status": "connected" }
  ],
  "permissionMode": "default"
}


Device bootstrap cache confirmed policy was applied:


{
  "builtinToolPolicy": { "Bash": "allow" },
  "chatAdvancedFileAnalysisEnabled": true
}


UI text shown to the user (not a log line): **“Claude wants to use bash”** → **Allow once** / **Deny**.

Steps to Reproduce

Steps to Reproduce

1. Deploy Claude Desktop on 3P with Amazon Bedrock SSO and bootstrap (or MDM) managed config. Minimum relevant keys:

{
  "inferenceProvider": "bedrock",
  "inferenceBedrockRegion": "<region>",
  "inferenceBedrockSsoStartUrl": "<sso-start-url>",
  "inferenceBedrockSsoRegion": "<sso-region>",
  "inferenceBedrockSsoAccountId": "<account-id>",
  "inferenceBedrockSsoRoleName": "<permission-set-name>",
  "inferenceModels": ["<bedrock-claude-model-id>"],
  "chatTabEnabled": true,
  "chatAdvancedFileAnalysisEnabled": true,
  "coworkTabEnabled": false,
  "isClaudeCodeForDesktopEnabled": false,
  "autoModeEnabled": false,
  "builtinToolPolicy": {
    "Bash": "allow"
  }
}

1. On macOS, install Claude Desktop for 3P (observed on 1.24012.9), import/configure bootstrap so the app loads the managed config above.

1. Confirm the policy was applied: open the in-app managed configuration UI → Built-in tool policy shows Bash = allow, source bootstrap/MDM.

1. Open the Chat tab (not Cowork / Code).

1. Attach any non-trivial file that triggers advanced file analysis (e.g. PDF, Excel, or PowerPoint), and send:

Can you summarize this file?

1. Observe Claude attempt sandbox analysis. When it runs a shell command (often first ls ../uploads/ or similar), the UI shows “Claude wants to use bash” with Allow once / Deny.

1. Click Allow once. On the next sandbox command in the same turn/conversation, the same prompt appears again.

Optional control (same machine / same config + Cowork enabled):

1. Set "coworkTabEnabled": true, refresh bootstrap, open Cowork, run a comparable sandbox bash action.

Expected contrast: Cowork does not prompt with Bash: allow; Chat still does.

Optional verification from local audit (macOS):

1. Inspect the Chat session audit under

~/Library/Application Support/Claude-3p/local-agent-mode-sessions/.../*/audit.jsonl
and confirm permission events use:

tool_name: "mcp__workspace__bash"
subtype: "permission_request"
decision: "once"

with tool_use_meta.display_name: "Bash" / server_display_name: "workspace".

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.219

Platform

AWS Bedrock

Operating System

macOS

Terminal/Shell

Other

Additional Information

Why this is confusing

• Docs say builtinToolPolicy applies in Chat like other tabs, and "allow" should pre-approve Bash.
• Runtime: Chat advanced file analysis uses mcp__workspace__bash. Bash: allow pre-approves Cowork, not Chat.
• disabledBuiltinTools: ["Bash"] disables Chat analysis; builtinToolPolicy.Bash: "allow" does not pre-approve it in Chat.

Local paths (macOS)

• ~/Library/Application Support/Claude-3p/claude_desktop_config.json → lastRemoteBootstrapPartial.builtinToolPolicy
• ~/Library/Application Support/Claude-3p/local-agent-mode-sessions/.../audit.jsonl → permission_request for mcp__workspace__bash

Versions

• Claude Desktop 1.24012.9 · embedded Claude Code 2.1.219 · macOS · Bedrock 3P

Prior escalation

https://github.com/aws-solutions-library-samples/guidance-for-claude-code-with-amazon-bedrock/issues/807#issuecomment-5166459977