[FEATURE] Non-managed System-wide `settings.json` (machine-wide defaults that users can still override)

Preflight Checklist

• [ ] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

Claude Code has exactly one machine-wide settings location — /etc/claude-code/managed-settings.json — and it is, by definition, managed: highest precedence and non-overridable. There is no system-wide tier that sets defaults for all users on a host while still letting each user or project override them. The only overridable settings are per-user (~/.claude/settings.json) or per-project (.claude/settings.json), neither of which is machine-wide. An admin who wants to establish a shared default (not a hard policy) currently has no place to put it.

This is all-or-nothing: to apply something to every user on a machine you must use the managed file, which enforces it — users can't adjust it even when the intent was just a sensible default. The naming reinforces the confusion — "managed" is the only system-level word users see, so people reach for it as "the system settings file" and unintentionally make things unoverridable. Every other config system has the layer that's missing here (/etc/skel, /etc/<app>/config vs. ~/.config, PAM, sudoers drop-ins): a system default layer below the user layer, distinct from an enforced policy layer above it.

Proposed Solution

Add a system-wide non-managed settings file, e.g. /etc/claude-code/settings.json, slotted into the precedence chain below the user file:

/etc/claude-code/managed-settings.json   (enforced policy — unchanged, wins over all)
command-line args
.claude/settings.local.json              (project, local)
.claude/settings.json                    (project, shared)
~/.claude/settings.json                  (user)
/etc/claude-code/settings.json           (NEW: system-wide default, lowest — overridable by any of the above)

• Same JSON schema as the other settings.json files.
• Purely a default provider: any user/project setting silently overrides it; the managed file still overrides everything.
• Platform paths mirror the managed file (/Library/Application Support/ClaudeCode/settings.json, C:\ProgramData\ClaudeCode\settings.json).

Alternative Solutions

Both of today's options are unsatisfactory:

• Use the managed file (all users, but non-overridable):

``json
// /etc/claude-code/managed-settings.json
{
"permissions": {
"allow": ["WebFetch", "WebSearch"]
}
}
``

This enforces the setting rather than defaulting it — users can't turn it off.

• Replicate per user: copy the setting into every user's ~/.claude/settings.json by hand. Overridable, but not machine-wide and not maintainable.

There is no way today to get "machine-wide default and overridable" at once.

Priority

High - Significant impact on productivity

Feature Category

CLI commands and flags

Use Case Example

Goal: every user on this machine can run WebFetch/WebSearch without a permission prompt by default — but any user or project can still tighten or disable it.

With the proposed non-managed system-wide file, the admin writes the default once:

// /etc/claude-code/settings.json   (NEW system-wide default, lowest precedence)
{
  "permissions": {
    "allow": ["WebFetch", "WebSearch"]
  }
}

Because this tier sits below the user file, it's a default, not a mandate. A user who wants web requests off again just overrides it in their own file:

// ~/.claude/settings.json  — this user opts back into prompting/denial
{
  "permissions": {
    "deny": ["WebFetch", "WebSearch"]
  }
}

A single project can do the same in .claude/settings.json, scoped to that repo. Contrast with the managed file, which would grant the same thing but make it unremovable — that is exactly the gap this request fills: the managed file gives "global" but not "overridable".

Additional Context

• Claude Code version: 2.1.198
• Platform: Linux (CLI / console)
• Related: precedence/behavior of managed-settings.json as the sole system-wide tier.