Indirect file access scope under Node.js `--experimental-permission` flag

Determine whether the experimental permission model applies permission checks to the caller’s path, the module’s path, or both when a core module or a user‑loaded module opens a file indirectly through require or import.

Because the flag switches the default for filesystem, child‑process, worker‑thread and addon access from allow‑all to deny‑all, existing scripts may fail, but the exact boundary for indirect accesses is not documented and varies between Node versions; path grants are interpreted as prefixes or globs and symlink or relative‑path resolution can shift the effective allow/deny result, making the transition to least‑privilege a compatibility risk rather than a simple flag toggle.

Does the permission check evaluate the resolved absolute path of the requested file, the path of the module performing the require/import, or both?
How do symlinks and relative paths affect the effective allow/deny decision for indirect file opens?
Is there a version‑dependent difference in which APIs (e.g., fs.readFile inside a core module) are covered by the permission model for indirect accesses?