{"version":"2.1.198","anchor":"windows-sandbox-per-exec-deny-flags","canonical_anchor":"windows-sandbox-per-exec-deny-flags","heading":"Windows Sandbox: Per-Exec Deny Flags","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.198\/e\/windows-sandbox-per-exec-deny-flags","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.198","markdown":"### Windows Sandbox: Per-Exec Deny Flags\n\n**What**\n\nWindows sandbox commands now support per-exec `denyRead` and `denyWrite` path lists, matching Linux\/macOS behavior.\n\n**Details**\n\n- Previously, Windows sandbox was deny-listed only at the session level\n- Now individual exec calls can pass `filesystem.denyRead` and `filesystem.denyWrite` path arrays\n- `filesystem.allowRead` (re-allow within denyRead) is still not supported on Windows \u2014 remove entries or narrow `denyRead`\n- `filesystem.allowWrite` is still not supported on Windows (Windows sandbox uses deny-list only)\n\n**Evidence**\n\nError messages (search for `\"Per-exec filesystem.allowRead (re-allow within denyRead) is not supported on Windows\"`)"}