You'll notice
The artifact tool now checks deny rules before running any non-read action.
The artifact tool's checkPermissions now checks deny rules before running any action other than read, blocking the call with a message naming the matching deny rule if one applies.