ENFORCED_MANAGED_KEYS

Manifest keys whose managed value must never resolve in the user's favor.

Every key here either grants a privilege (approval mode, the YOLO entry in the Shift+Tab cycle, shell auto-approval, the interpreter, its programmatic tool-calling list, and the acknowledgement that exposes every tool to it) or draws a containment boundary (the skill-content allowlist, the recursion limit, the classifier that reviews gated actions, and trace redaction). Ignoring an unusable value for one of these leaves the user's own flag or environment variable in force, which is the escalation the policy meant to forbid, so the launch stops instead.

sandboxes.default is enforced for its value, not as a containment boundary. It names which backend a bare --sandbox selects; it does not decide whether to sandbox, so a launch that asks for no sandbox still runs on the host. Enforcement here rejects a value that cannot be applied, and _apply_managed_sandbox prints a notice when a launch bypasses the named backend, so the gap is visible rather than assumed away.

startup.mode and startup.yolo_switcher must both be listed. Pinning the approval mode while leaving the YOLO entry unenforced keeps unrestricted mode one keypress away in the same file.

Keys that cannot grant privilege keep the ordinary ignore-and-fall-through rule. test_every_enforced_managed_key_resolves_to_a_manifest_option pins each entry to a manifest option, because managed_policy_violations skips a key it cannot resolve, so a rename would turn enforcement into a silent no-op.