@@ -16,6 +16,7 @@ import { AbsolutePath } from "./schema.js"
 import { ConfigVariable } from "./config/variable.js"
 import { ConfigNormalize } from "./config/normalize.js"
 import { ConfigDiscovery } from "./config/discovery.js"
+import { ConfigManaged } from "./config/managed.js"
 import { ConfigWatch } from "./config/watch.js"
 import { WellKnown } from "./wellknown.js"
 
@@ -40,6 +41,8 @@ export interface Interface {
   readonly changes: () => Stream.Stream<Watcher.Update>
   /** Updates supported global config fields while preserving unrelated JSONC content. */
   readonly update?: (patch: Patch) => Effect.Effect<void, FSUtil.Error>
+  /** Paths admin-managed documents load from; the policy plugin ranks their statements above authored ones. */
+  readonly managed?: readonly AbsolutePath[]
 }
 
 export const Options = Schema.Struct({
@@ -49,6 +52,14 @@ export const Options = Schema.Struct({
   global: Schema.optional(Schema.Boolean),
   file: Schema.optional(Schema.String),
   content: Schema.optional(Schema.String),
+  // Defaults to the platform's system-managed locations. Hosts and tests set
+  // this explicitly; `{}` disables managed configuration.
+  managed: Schema.optional(
+    Schema.Struct({
+      directory: Schema.optional(Schema.String),
+      preferences: Schema.optional(Schema.Array(Schema.String)),
+    }),
+  ),
 })
 export type Options = typeof Options.Type
 
@@ -70,6 +81,7 @@ export const testLayer = (
     claude: [],
     agents: [],
   },
+  managed: readonly AbsolutePath[] = [],
 ) =>
   Layer.effectContext(
     Effect.gen(function* () {
@@ -79,6 +91,7 @@ export const testLayer = (
         entries: () => Ref.get(entries),
         compatibility: () => Effect.succeed(compatibility),
         changes: () => Stream.fromPubSub(updates),
+        managed,
         setEntries: (next) => Ref.set(entries, next),
         emitChange: (update) => PubSub.publish(updates, update).pipe(Effect.asVoid),
       })
@@ -191,6 +204,21 @@ export const layer = (options?: Options) =>
         ]
       })
 
+      const managedPaths = options?.managed ?? ConfigManaged.systemPaths()
+      // Managed documents rank above every other source so users and
+      // repositories cannot override administrator-enforced settings.
+      const loadManaged = Effect.fn("Config.loadManaged")(function* () {
+        const managed = yield* ConfigManaged.sources(managedPaths)
+        return yield* Effect.forEach(managed, (source) =>
+          ConfigVariable.substitute({ type: "path", path: source.path, text: source.text }).pipe(
+            Effect.flatMap((text) => parseInfo(text, source.path)),
+            Effect.map((info) =>
+              info ? new Document({ type: "document", path: AbsolutePath.make(source.path), info }) : undefined,
+            ),
+          ),
+        ).pipe(Effect.map((documents) => documents.filter((document) => document !== undefined)))
+      })
+
       const load = Effect.fn("Config.load")(function* (sources: ConfigDiscovery.Sources) {
         const direct = yield* Effect.forEach(sources.direct, (filepath) => loadFile(filepath)).pipe(
           Effect.orDie,
@@ -234,6 +262,7 @@ export const layer = (options?: Options) =>
           ...direct,
           ...projectSupplementary,
           ...content,
+          ...(yield* loadManaged().pipe(Effect.orDie)),
         ]
       })
 
@@ -359,6 +388,7 @@ export const layer = (options?: Options) =>
           }),
         changes: () => Stream.fromPubSub(updates),
         update,
+        managed: ConfigManaged.candidates(managedPaths).map((file) => AbsolutePath.make(file)),
       })
     }),
   )
 
@@ -0,0 +1,107 @@
+export * as ConfigManaged from "./managed.js"
+
+import os from "os"
+import path from "path"
+import { Effect } from "effect"
+import { FSUtil } from "@opencode/util/fs-util"
+import { names } from "./discovery.js"
+
+const DOMAIN = "ai.opencode.managed"
+
+// Keys macOS/MDM injects into the managed payload that are not OpenCode config.
+const PLIST_META = new Set([
+  "PayloadDisplayName",
+  "PayloadIdentifier",
+  "PayloadType",
+  "PayloadUUID",
+  "PayloadVersion",
+  "_manualProfile",
+])
+
+export interface Paths {
+  /** Admin-owned directory holding `opencode.json(c)`; omitted disables it. */
+  readonly directory?: string
+  /** macOS managed-preference plists in lookup order; the first readable one wins. */
+  readonly preferences?: readonly string[]
+}
+
+export interface Source {
+  readonly path: string
+  readonly text: string
+}
+
+/** Where administrators deploy managed configuration on the current platform. */
+export function systemPaths(platform: NodeJS.Platform = process.platform, username = currentUser()): Paths {
+  if (platform === "darwin")
+    return {
+      directory: "/Library/Application Support/opencode",
+      preferences: [
+        path.join("/Library/Managed Preferences", username, `${DOMAIN}.plist`),
+        path.join("/Library/Managed Preferences", `${DOMAIN}.plist`),
+      ],
+    }
+  if (platform === "win32") return { directory: path.join(process.env.ProgramData || "C:\\ProgramData", "opencode") }
+  return { directory: "/etc/opencode" }
+}
+
+/** Every path a managed source can be read from. */
+export function candidates(paths: Paths): string[] {
+  return [...directoryFiles(paths), ...(paths.preferences ?? [])]
+}
+
+function directoryFiles(paths: Paths) {
+  const directory = paths.directory
+  return directory ? names.map((name) => path.join(directory, name)) : []
+}
+
+/** Converts `plutil -convert json` output into config JSON by dropping MDM metadata keys. */
+export function parsePlist(json: string): Record<string, unknown> {
+  const raw: unknown = JSON.parse(json)
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+    throw new Error("managed plist root is not a dictionary")
+  return Object.fromEntries(Object.entries(raw).filter(([key]) => !PLIST_META.has(key)))
+}
+
+/** Reads managed sources from lowest to highest priority: directory files, then the first readable plist. */
+export const sources = Effect.fn("ConfigManaged.sources")(function* (paths: Paths) {
+  const fs = yield* FSUtil.Service
+  const result: Source[] = []
+  for (const file of directoryFiles(paths)) {
+    const text = yield* fs
+      .readFileStringSafe(file)
+      .pipe(
+        Effect.catch((error) =>
+          Effect.logWarning("failed to read managed config", { source: file, error }).pipe(Effect.as(undefined)),
+        ),
+      )
+    if (text !== undefined) result.push({ path: file, text })
+  }
+  for (const plist of paths.preferences ?? []) {
+    if (!(yield* fs.isFile(plist))) continue
+    const text = yield* Effect.tryPromise(() => convertPlist(plist)).pipe(
+      Effect.catch((error) =>
+        Effect.logWarning("failed to read managed preferences", { source: plist, error }).pipe(Effect.as(undefined)),
+      ),
+    )
+    if (text === undefined) continue
+    result.push({ path: plist, text })
+    break
+  }
+  return result
+})
+
+async function convertPlist(plist: string) {
+  // Imported lazily: only macOS hosts with a deployed profile ever spawn plutil.
+  const { execFile } = await import("node:child_process")
+  const { promisify } = await import("node:util")
+  const { stdout } = await promisify(execFile)("plutil", ["-convert", "json", "-o", "-", plist])
+  return JSON.stringify(parsePlist(stdout))
+}
+
+function currentUser() {
+  try {
+    return os.userInfo().username || "user"
+  } catch {
+    return "user"
+  }
+}
@@ -14,16 +14,23 @@ export const Plugin = define({
     const config = yield* Config.Service
     const managed = yield* ManagedPolicy.Service
     const loaded = yield* ConfigEntryObserver.observe(config, ctx.event, ctx.provider.reload())
-    // Authored documents reverse so user-global policy outranks repository policy; organization statements
-    // from the connected Console follow every authored one and have the final say.
+    const managedPaths = new Set<string>(config.managed ?? [])
+    const isManaged = (entry: Document) => entry.path !== undefined && managedPaths.has(entry.path)
+    // Authored documents reverse so user-global policy outranks repository policy; administrator-managed
+    // documents follow them, and organization statements from the connected Console have the final say.
     const policies = () => {
       const organization = managed.current()
+      const documents = loaded.entries.filter((entry): entry is Document => entry.type === "document")
       return [
-        ...loaded.entries
-          .filter((entry): entry is Document => entry.type === "document")
+        ...documents
+          .filter((entry) => !isManaged(entry))
           .toReversed()
           .flatMap((entry) => entry.info.experimental?.policies ?? [])
           .map((policy) => ({ ...policy, message: "Blocked by configuration policy" })),
+        ...documents
+          .filter(isManaged)
+          .flatMap((entry) => entry.info.experimental?.policies ?? [])
+          .map((policy) => ({ ...policy, message: "Blocked by managed configuration policy" })),
         ...organization.statements.map((policy) => ({
           ...policy,
           message: organization.organization
 
@@ -56,7 +56,8 @@ function testLayer(
     ),
   )
   const built = AppNodeBuilder.build(LayerNode.group([Config.node, Bus.node]), [
-    Config.node.replace(Config.configured(options)),
+    // Managed config is disabled unless a test opts in, so host MDM profiles never leak in.
+    Config.node.replace(Config.configured({ managed: {}, ...options })),
     Location.node.replace(locationLayer),
     Global.node.replace(Global.layerWith({ config: globalDirectory, home: path.join(globalDirectory, "home") })),
     Credential.node.replace(credentialNode),