Claude Code 2.1.283 lets admins pin exact model versions

Claude Code 2.1.283, released 25 Sep, gives admins a way to freeze which model versions their team can run. The new availableModelsMatch setting takes an "exact" mode: list a model version in availableModels and only that version works, so a new release from Anthropic stays blocked until someone adds it to the list. A companion deniedModels setting blocks specific models outright, per the Claude Code changelog.

The stakes are configuration drift. Teams write CLAUDE.md files, skills, agents and slash commands around the quirks of whatever model they tested against. When Anthropic ships a new model and an org's settings auto-upgrade to it, those instructions can go stale without anyone noticing, sometimes silently changing agent behavior in production.

That's what the second change addresses. /doctor now runs a prompt-audit that checks CLAUDE.md files, skills, agents and commands for patterns written for older models. It surfaces stale paths, stale commands and instruction files that contradict each other, sorted to the top of the output.

Two other behavior changes matter if you run Claude Code unattended. Managed sandbox settings used to fail silently on one bad nested value, ignoring the whole block. Now only that value fails, so the rest of the sandbox config still applies. And interactive sessions using third-party providers, or with telemetry disabled, now default to auto mode when no permission mode is set. If you were relying on Claude Code to prompt before acting, set permissions.defaultMode explicitly or a script that expects a prompt will instead run.

The changenotes don't say whether deniedModels and availableModelsMatch can be combined in one policy, or what happens when they conflict. Anyone rolling this out to a team should test that interaction rather than assume it's handled.