Publishing or reading artifacts outside your organization's consented locations now requires consent

What

• Writing a file or asset (an artifact's underlying content) to a location outside consented organization locations is now explicitly refused, with reasons like file_outside_org_unasked, asset_outside_org_unasked, or asset_copy_outside_org_unasked, and a new artifact_outside_org_consent telemetry event records it.
• Reading the HTML page of a public artifact from outside your organization now goes through an admitPublicRead approval check, which defaults to refusing; without explicit approval, the read is blocked instead of silently fetched.
• The artifact file-read path no longer gives one generic 403 message for all outside-org reads. It now distinguishes cases: for a "publicFile", it explains the bytes aren't returned inline but can be saved to disk via a tool instead; for a "publicUnasked" case (nobody could be asked for consent), it gives a specific explanation and logs telemetry marking the request refused. The approval check itself is now wired to a real permission-aware function that considers prior grants, whether a human started the turn, and the current mode (for example, plan mode).

Why

This prevents artifacts from being silently written to or read from outside boundaries your organization has consented to, while giving clearer, case-specific explanations instead of one blanket block, and still allowing access once consent has actually been granted.