You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
PermissionsArea: what it touches
ImprovementsKind: in v2.1.239,
ImprovementsSection of the release
What
If an artifact action arrives with internal approval fields that no completed permission check attached to that call, the action is denied and the permission classifier cannot approve it. The denial message points at hooks or SDK hosts injecting the fields. This check always runs.
Evidence
Artifact consent markers not minted by a completed permission check fail closed
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
