[BUG] Managed.settings.json & settings.json

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

I am using Windows and Claude CLI, trying to implement restriction access. I have chatted with the Claude & it has created the attached 2 files & place it into c:\users\%USERPROFILE%\.claude\
However, after relaunch the Claude from c:\users\%USERPROFILE%, it can access files in c:\temp
Kindly pls assist on this.

managed-settings.json
settings.json

What Should Happen?

supposed with these managed.settings.json & settings.json files, claude should not able to access any other files except C:\Users\%USERPROFILE%\Desktop\Claude Code\Lab but the sandbox does not work. Then Claude asked me to lodge this issue here...

Error Messages/Logs

no error

Steps to Reproduce

{
"$schema": "https://json.schemastore.org/claude-code-settings.json",

"forceLoginMethod": "console",

"permissions": {
"deny": [
"Read(/.env)",
"Read(/.env.*)",
"Read(/secrets/)",
"Read(**/*.pem)",
"Read(**/*.key)",
"Read(%USERPROFILE%/.ssh/)",
"Read(%USERPROFILE%/.aws/)",
"Read(%USERPROFILE%/.config/gcloud/)",
"Read(%USERPROFILE%/.azure/)",
"Read(%USERPROFILE%/.gnupg/**)",
"Bash(curl:*)",
"Bash(wget:*)",
"Bash(ssh:*)",
"Bash(scp:*)",
"Bash(nc:*)",
"Bash(rm -rf:*)"
]
},

"allowManagedPermissionRulesOnly": true,
"disableBypassPermissionsMode": "disable",

"sandbox": {
"enabled": true,
"allowUnsandboxedCommands": false,
"filesystem": {
"denyRead": [
"C:\\Users\\"
],
"allowRead": [
"%USERPROFILE%\\Desktop\\Claude Code\\Lab\\"
]
}
},

"allowedMcpServers": [
"your-approved-server-1",
"your-approved-server-2"
],
"deniedMcpServers": [],
"allowManagedHooksOnly": true,
"strictKnownMarketplaces": true,

"cleanupPeriodDays": 7,

"env": {
"CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1"
},

"companyAnnouncements": [
"Claude Code on this device is centrally managed. Contact #security if you hit a blocked action you believe is a false positive.",
"Do not connect unapproved MCP servers — request review via #security first."
]
}

Claude Model

Other

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

Claude Haiku 4.5

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

_No response_