{"version":"2.1.223","anchor":"permission-denied-events-fire-even-without-a-permission-prom","canonical_anchor":"permission-denied-events-fire-even-without-a-permission-prom","heading":"permission_denied events fire even without a permission prompt","tier":"notice","area":"Permissions","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.223\/e\/permission-denied-events-fire-even-without-a-permission-prom","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.223","markdown":"### permission_denied events fire even without a permission prompt\n\nHeadless and SDK runs now report permission denials even when no prompt was ever shown.\n\n**What**\n\nDenials are now reported in headless runs that have no prompt surface, not just when a prompt was shown.\n\n**Details**\n\n- emission was factored into a reusable `emitPermissionDenied`\n- the no-transport path now emits it for non-allow decisions too\n- the schema description was rewritten to state that with bare `-p`, or SDK `query()` without `canUseTool`, 'ask' decisions are terminal and are also reported\n- the event is documented as best-effort advisory\n\n**Evidence**\n\n`Best-effort advisory: in rare races a denial can book without a frame or a frame can lack a booking twin`\n\n- Area: Permissions\n- Names: `-p`, `canUseTool`\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 0\/5"}