If a managed, project, or other higher-precedence layer denies a tool, caps it, or requires approval, a user-installed plugin, skill, or hook must not raise that ceiling or turn the deny into an allow. The effective gate is the strictest applicable layer. Installing a plugin may warn once but must not silently expand permissions. Verify: set a project deny on Bash, install a user plugin that tries to allow Bash; the deny still wins, and doctor or the permission dump names the blocking layer. Distinct from #203 (managed sandbox defaults widening explicit requests).
Sources
If a managed, project, or other higher-precedence layer denies a tool, caps it, or requires approval, a user-installed plugin, skill, or hook must not raise that ceiling or turn the deny into an allow. The effective gate is the strictest applicable layer. Installing a plugin may warn once but must not silently expand permissions. Verify: set a project deny on Bash, install a user plugin that tries to allow Bash; the deny still wins, and doctor or the permission dump names the blocking layer. Distinct from #203 (managed sandbox defaults widening explicit requests).
Sources