When a restriction is not enforced

A task's permissions say what its session may touch: which tools it uses, where it writes and reads, whether it reaches the network. HarmFlow applies them through the AI tool's own controls. When the AI tool or the operating system cannot enforce one of these restrictions, HarmFlow warns you with Restriction not enforced. This page says what the warning means, where it shows, what makes a restriction count as not enforced, and how to hide it on an execution.

What the warning means

The task still runs. HarmFlow does not stop or refuse a task because a restriction it declares cannot be enforced: it runs the task with the controls the AI tool has, and tells you which restriction those controls do not hold. The warning names each restriction that is not enforced, and why, such as a shell command that may read outside the workspace, or a settings file that allows more than the task's tool list.

Read it as a statement of fact about the run, not as an error: the session may do what that restriction meant to prevent. Change the task's permissions, or the settings the warning names, if that matters to you.

Where the warning shows

• On the task's row in the Tasks screen, as its warnings chip, such as 1 warning. The chip's tooltip names the warning and its message.
• In the task editor, among the Warnings of the task's validation, beside its errors.
• On the execution: as a banner in its detail, and in the Warnings list of its Results tab. Reading executions describes the detail and its tabs.

The execution's Events tab and its log also record each restriction that is not enforced.

What lifts a restriction

A restriction counts as not enforced when another settings source the AI tool loads can lift it. For Claude Code, these are the allow rules, and the additional directories, of its settings files:

• its user settings, settings.json in Claude Code's configuration folder;
• its project settings, .claude/settings.json in the task's workspace;
• its local settings, .claude/settings.local.json in the task's workspace.

Claude Code adds what these files allow to what the task allows. When a file allows more than the task's permissions, such as a tool the task's list leaves out, or edits or reads outside the workspace, the warning names that file's source: "user settings", "project and local settings", and so on. Claude Code's managed settings are not checked, and the warning says so.

• A file HarmFlow cannot read, or one that exists but does not parse, counts as lifting the restriction: HarmFlow cannot tell what it allows. The warning names it too.
• A missing file lifts nothing.

HarmFlow checks these sources twice. When you save a task, it reads your user settings. When each execution starts, it reads every source again, the workspace's own project and local settings included, so a warning can appear on an execution that the task's row did not show.

Codex has controls of its own, and its own restrictions it cannot enforce. One of them comes from its managed requirements, which have a page of their own: Codex's managed requirements.

Hiding the warning on an execution

In Settings, under General, the Executions panel has the option Show restriction warnings. It is on by default.

Turning it off hides the warning in an execution's detail: the banner, and its entry in the Warnings of the Results tab. The change takes effect at once. While it is off:

• the execution's Events tab still lists each restriction that is not enforced;
• the warning on the task's row, and in the task editor, still shows.

The option hides the warning; it changes nothing about the run. The restriction is still not enforced.