{"version":"2.1.273","anchor":"new-per-tool-hardblockunder-config-drives-a-hard-block-loo","canonical_anchor":"hipaa-policy-settings-gain-a-hard-block-tier","heading":"New hardBlockUnder tier for tool and compliance policies","tier":"internal","area":"Elsewhere","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.273\/e\/new-per-tool-hardblockunder-config-drives-a-hard-block-loo","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.273","markdown":"### New hardBlockUnder tier for tool and compliance policies\n\nTool and HIPAA compliance settings gain a stricter hardBlockUnder enforcement tier beyond the existing deny list\n\n**Unclear.** What conditions or values `hardBlockUnder` actually enforces isn't given in the finding.\n\n**What**\n\n- Several HIPAA compliance settings (Memory sync, Projects, Team onboarding, Peer messaging) now carry a `hardBlockUnder: [\"hipaa\"]` property alongside the existing `deniedUnder`, marking a stricter enforcement tier separate from ordinary denial.\n\n- A new lookup table is built by collecting each tool's `hardBlockUnder` configuration, pairing each named threshold with the tool it applies to. The related deny-on-cache-miss list was also simplified to be built directly from each tool's configuration instead of a fixed base list plus filtering.\n\n**Why** This adds a stricter \"hard block\" enforcement level on top of the existing deny mechanism, letting specific settings and tools be blocked outright under certain compliance thresholds (like HIPAA) rather than just denied through the normal path.\n\n- Area: Elsewhere\n- Names: `hardBlockUnder`\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 2\/5"}