{"version":"2.1.274","anchor":"publishing-artifacts-outside-org-consented-locations-is-now","canonical_anchor":"publishing-artifacts-outside-org-consented-locations-is-now","heading":"Publishing or reading artifacts outside your organization's consented locations now requires consent","tier":"notice","area":"Artifacts","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.274\/e\/publishing-artifacts-outside-org-consented-locations-is-now","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.274","markdown":"### Publishing or reading artifacts outside your organization's consented locations now requires consent\n\nWriting or reading artifacts outside org-consented locations is refused unless approved, replacing a flat hard block\n\n**What**\n\n- Writing a file or asset (an artifact's underlying content) to a location outside consented organization locations is now explicitly refused, with reasons like `file_outside_org_unasked`, `asset_outside_org_unasked`, or `asset_copy_outside_org_unasked`, and a new `artifact_outside_org_consent` telemetry event records it.\n\n- Reading the HTML page of a public artifact from outside your organization now goes through an `admitPublicRead` approval check, which defaults to refusing; without explicit approval, the read is blocked instead of silently fetched.\n\n- The artifact file-read path no longer gives one generic 403 message for all outside-org reads. It now distinguishes cases: for a \"publicFile\", it explains the bytes aren't returned inline but can be saved to disk via a tool instead; for a \"publicUnasked\" case (nobody could be asked for consent), it gives a specific explanation and logs telemetry marking the request refused. The approval check itself is now wired to a real permission-aware function that considers prior grants, whether a human started the turn, and the current mode (for example, plan mode).\n\n**Why**\n\nThis prevents artifacts from being silently written to or read from outside boundaries your organization has consented to, while giving clearer, case-specific explanations instead of one blanket block, and still allowing access once consent has actually been granted.\n\n- Area: Artifacts\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5"}