You'll notice
An artifact read that might belong to someone else now fails closed with its own reason when the check cannot complete.
Permission checks for artifact reads now have a dedicated fail-closed reason for reads that may belong to another person, distinct from the existing plan-mode and cowork-frame fail-closed cases. When such a check can't complete, it fails closed rather than allowing the read.