Managed Settings Only Lockdown Flags

{
  "allowManagedPermissionRulesOnly": true,
  "allowManagedMcpServersOnly": true,
  "allowManagedHooksOnly": true
}

allowManagedPermissionRulesOnly — prevent user/project settings from defining any allow/ask/deny rules.
allowManagedMcpServersOnly — only the admin-defined MCP allowlist applies; user additions are ignored.
allowManagedHooksOnly — only managed-settings and SDK hooks run; user/project/plugin hooks are blocked.