{"version":"2.1.233","anchor":"permission-rules-now-apply-to-artifacts-fetched-without-a-pr","canonical_anchor":"permission-rules-now-apply-to-artifacts-fetched-without-a-pr","heading":"Permission rules now apply to artifacts fetched without a prompt","tier":"notice","area":"Permissions","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.233\/e\/permission-rules-now-apply-to-artifacts-fetched-without-a-pr","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.233","markdown":"### Permission rules now apply to artifacts fetched without a prompt\n\nYour deny and ask rules now apply to artifacts pulled automatically by a watching session.\n\n**What**\n\nWhen a session started with `--watch-artifact` pulls an artifact with no user prompt behind it, having the artifact tool enabled is no longer enough on its own: matching deny or ask permission rules for that tool now block the read. Previously this path returned allowed outright.\n\n**Details**\n\n- Only reached when the artifact read surface is enabled in the first place; prompt-driven reads are unchanged.\n\n**Evidence**\n\n`promptless`\n\n- Area: Permissions\n- Names: `--watch-artifact`\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5"}