`sec-default` puts a security boundary between an organization's managed settings and the plugins employees install

GitHub·high signalXBlueskyLinkedInCopy link

Because function hooks give every plugin a say on every event, things an org previously controlled outright (classic hooks, managed CLAUDE.md and rules, settings, the MCP allowlist) became reachable from the user tier. `sec-default` is seated first in the prepend tier on any machine with managed settings or for a Team/Enterprise org, and has exactly three moves: `next.to(e, "append")` to skip the user tier, `{ deny }` for a user-tier caller, or pass. It skips the user tier on `classic.*`, `prompt.section`, `prompt.context`, `skill.prompt`, `attribution.text` and `settings.read`, and fails closed, so an unreadable policy counts as a policy in force.