Claude Code 2.1.283 allowManagedPermissionRulesOnly: Sume tools

If your organisation sets allowManagedPermissionRulesOnly, a plugin from a marketplace, claude.ai or npm can no longer pre-approve its own tools through allowed-tools in Claude Code 2.1.283 (2026-09-25). Only official Anthropic sources or sources vouched for by managed settings keep that ability, so a third-party plugin cannot quietly allow Sume's paid tools.

That is the behaviour you want for a spend-capable server, and it means the approval has to come from your managed rules.

What changed

Before 2.1.283, a plugin's allowed-tools list could pre-approve tools even in a locked-down managed setup. Now, under the managed-only setting, that pre-approval is honoured only for official Anthropic or managed-vouched sources.

At a glance

Applying it to Sume

Sume has one hosted MCP server with two OAuth scopes. mcp:read is required and shows read tools; mcp:write is opt-in and exposes mutating and paid tools. There is no separate paid scope, so the permission rule is where you express which paid tools may run unattended.

Write your Sume rules in managed settings, and keep per-call guards in the tool arguments: idempotency_key is required on write and paid calls, and max_spend_usd is available as a ceiling.

• Put Sume allow rules in managed settings, not plugin manifests.
• Allow read tools broadly and write tools narrowly.
• Add a hook or spend cap for unattended runs.

Limits and what is not verified

The changelog describes the vouching mechanism only briefly; consult Anthropic's managed settings documentation for the exact keys. I did not run Claude Code under this setting against Sume.