Claude Code 2.1.316 merges every policy that matches

On October 31, 2026, the Claude Code changelog posted version 2.1.316. The GitHub release page for tag v2.1.316 records that release on 31 Oct. The docs page says it is generated from CHANGELOG.md in the claude-code repository. To see the installed version, the changelog says to run claude --version.

Read those lines before the version reaches the machines you look after. They cover which policies apply to one developer, what effort a subagent uses, whether a group shares a monthly budget, and when a fast-mode call starts returning an error.

When layered mode is on

The release adds managed.policy_mode: layered on the Claude apps gateway. In that mode, every policy that matches a developer applies, each merged over the ones listed below it, not only the first.

The release adds the mode. It does not say the mode is already selected for every organization. When the value is layered, list order is the check: every matching policy applies, and each one is merged over the ones listed below it.

For Team and Enterprise logins, settings fetched from Anthropic’s API now apply without an approval prompt. A stored copy that does not verify is refused.

The gateway’s model check is a separate fix in the same notes. The gateway had not been checking every model a request names against availableModels, deniedModels, and models. A request that names a blocked model now gets a 400 naming the field. That status code is company-reported.

Auto mode has two lines, left side by side.

On scheduled-task prompts, an autoMode.allow list without "$defaults" no longer removes the built-in rule.

A managed autoMode.allow list without "$defaults" was getting the built-in exceptions back from a host app’s --settings, from a first rule added in /permissions, or from /auto-mode-setup. The release lists that as fixed. Write down which of those three paths you use, then read the scheduled-task line again.

Effort, a shared budget, and November 30

CLAUDE_CODE_SUBAGENT_EFFORT sets the effort level subagents run at when nothing else names one, instead of inheriting the session’s.

A model fix sits beside that variable. Sub-agents that inherited a parent sub-agent’s model were moving to the main model when a background job or a message woke them. The release lists that move as fixed. The effort line does not describe the model line.

Pooled group budgets are new on the Claude apps gateway. The company-reported wording is one monthly budget that a group’s members share, on top of each member’s own limit, set with pooled_budget on the spend limits admin API. The note gives no amount.

Fast mode for Opus 4.8 is dated in the same release. It is deprecated as of October 30, 2026, and the notes say it will be removed on November 30, 2026. After removal, fast mode requests on Opus 4.8 return an error and do not fall back to standard Opus 4.8. The release says to migrate to Opus 5.5 to keep the speedup. It states no speed and no price.

When /model is given an id this version does not recognize, auto-compact will assume a 200K context window. The 200K figure is company-reported. The release says /model had not been warning in that case. The same sentence still says auto-compact will assume 200K.

A Read rule and a shell left running

The release lists a fix for --restricted sessions uploading files from outside the working directories when a Read allow rule covered them.

On macOS and Linux, it also lists a fix for shell commands left running when Claude Code exits by itself, for example when credentials are refused or a cloud session is archived.

A pass on one install

Run this on one machine you would bump. Write what you see. The pass records the 2.1.316 lines against that install.

1. Run claude --version. The changelog names that command. The lines in this post are the 2.1.316 notes.
2. If the machine uses the Claude apps gateway, read managed.policy_mode. When it is layered, list every policy that matches one developer, in listed order. Every match applies, and each policy is merged over the ones listed below it.
3. For a Team or Enterprise login, write the settings line on the same page: fetched settings apply without an approval prompt, and a stored copy that does not verify is refused.
4. Check whether anything else already names an effort for subagents. CLAUDE_CODE_SUBAGENT_EFFORT is the level they run at when nothing else names one.
5. Read pooled_budget for one group on the spend limits admin API. Write the value shown. The notes describe one shared monthly budget on top of each member’s own limit.
6. Find callers that still request fast mode on Opus 4.8. The notes set removal on November 30, 2026. After that removal, those requests return an error and do not fall back to standard Opus 4.8.
7. If a Read allow rule is in use with --restricted, re-read the upload line before you add a path. On macOS or Linux, check any runbook that expects a shell to remain after Claude Code exits on its own.

What to do this week

• Read the 2.1.316 section on the changelog, then the same bullets on the GitHub release.
• On one page, write the policy list for one developer, the subagent effort value you find, and the pooled_budget value the API shows.
• Name the caller that still sends Opus 4.8 fast mode, and write November 30, 2026 next to it.
• Re-read the restricted-session upload line before you extend a Read allow rule.