policy-and-managed-settings
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFE
Full Analysis
- Policy Management Architecture: The skill provides detailed instructions on how enterprise policies are declared, exported, and enforced. This includes a clear flowchart for determining where a policy should reside (SDK/runtime vs. VS Code core), which is a standard security best practice for maintaining authoritative enforcement points.
- External Configuration Ingestion: The documentation describes how 'managed settings' are delivered via native MDM (Windows registry/macOS plist), GitHub server endpoints, and local files. The skill outlines a 'most-restrictive-wins' precedence model and emphasizes the use of a shared normalizer (
normalizeManagedSettings) and projection logic (projectManagedSettings) to validate and type-check external input before it is applied to the agent's configuration. - Development and Testing Tools: The skill references local development tools, including an
npm run mock-policy-serverfor simulating policy responses and anexport-policy-datascript for generating catalog artifacts. These are standard engineering practices for verifying policy behavior in isolated environments. - Security Boundary Documentation: The guides explicitly discuss the separation of concerns between sandbox containment and permission authorization, ensuring that policy state and execution environments remain aligned without expanding access unexpectedly.
- Vendor-Specific Resources: The skill refers to internal Microsoft and VS Code repositories and packages, such as
@vscode/policy-watcher. These references are consistent with the skill's purpose as a guide for developers working on the official product suite.
Audit Metadata