# n8n environment access boundary experiment

Status: `VERIFIED`.

This protocol checks whether `N8N_BLOCK_ENV_ACCESS_IN_NODE` changes access to one harmless sentinel environment variable in two workflow surfaces:

- `workflow-code.json` reads `$env.EXPERIMENT_SENTINEL` in a Code node.
- `workflow-expression.json` reads the same value in a Set node expression.

Two fresh n8n 2.30.5 containers are started with network access disabled. One explicitly sets `N8N_BLOCK_ENV_ACCESS_IN_NODE=true`; the other sets it to `false`. Both receive the public value `PUBLIC_SENTINEL_20260724`, not a credential or production secret.

Each mode and workflow pair is executed ten times for a target of 40 workflow executions. The runner records structured execution status, exit code, whether the sentinel was returned, normalized error category, duration, and an output hash.

All 40 executions matched the frozen protocol:

- Blocked / Code node: 10/10 execution failures, 0 sentinel observations.
- Blocked / expression: 10/10 execution failures, 0 sentinel observations.
- Open / Code node: 10/10 execution successes, 10 sentinel observations.
- Open / expression: 10/10 execution successes, 10 sentinel observations.

The expression surface reported `access to env vars denied`. The Code node exposed the same denial reason inside an additional read-only Error property wrapper. The runner classifies the shared denial reason while retaining the normalized first sample in `samples.json`.

This result verifies an explicit true/false comparison for n8n 2.30.5. It does not infer defaults for other versions or hosting products, and it does not treat environment variables as a secrets-management system.