{"version":"2.1.248","anchor":"restricted-sessions-drop-implicit-file-allowances-and-cannot","canonical_anchor":"restricted-sessions-drop-implicit-file-allowances-and-cannot","heading":"Restricted sessions drop implicit file allowances and cannot be talked out of a denial","tier":"notice","area":"Permissions","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.248\/e\/restricted-sessions-drop-implicit-file-allowances-and-cannot","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.248","markdown":"### Restricted sessions drop implicit file allowances and cannot be talked out of a denial\n\nRestricted sessions drop implicit file allowances, and a denial can't be argued away.\n\n**What**\n\nIn a restricted session the permission checker skips the usual implicit allowances (workflow script files, agent memory `.md` files, `.claude\/launch.json`, and \"project directory files are allowed for reading\"), and a denial from a safety check can no longer be rescued by the automatic approval classifier.\n\n**Details**\n\n- Safety-check denials are returned as not classifier-approvable, tagged with a dedicated circuit breaker that is registered as immune to bypass and never routed to the classifier.\n- The relaxations that remote mode normally applies are suppressed when the session is restricted.\n- Only reachable when the session was started with `--restricted` or `CLAUDE_CODE_RESTRICTED`.\n\n**Evidence**\n\n`{ classifierApprovable: !1, circuitBreaker: \"restrictedMode\" }`, `circuitBreaker: \"restrictedMode\"`, `restrictedMode: { bypassImmune: !0, classifierRouted: !1 }`\n\n- Area: Permissions\n- Names: `--restricted`, `CLAUDE_CODE_RESTRICTED`\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5"}