You'll notice
With read blocking on, an outside-directory read now throws its own dedicated error rather than a generic denial.
With the new read-block setting enabled, attempts to read a path outside the working directories now throw a distinct, dedicated error instead of falling through to the general permission-denied path.