You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
AgentsArea: what it touches
ImprovementsKind: in v2.1.296,
ImprovementsSection of the release
What
A permission answer can allow a call and also send updatedPermissions, which are changes to the permission rules. If those changes go over the size limit, or are malformed, they might hide a deny or ask rule. In that case Claude Code now refuses the call instead of running it. Before, extra or malformed changes were cut down or ignored without notice, and the call still ran.
An oversized list is cut short, and a deny rule is added at the cut point. The refusal message says the call was not run because the answer allowed it and also asked for rule changes.
Why
Before, an answer could let a call through while some of its own deny rules quietly failed to take effect. Refusing the call means a blocked action cannot slip through that way.
