diff --git a/docs/guides/sdlc-pipeline.md b/docs/guides/sdlc-pipeline.md
index face9e2650..8ae10db44e 100644
--- a/docs/guides/sdlc-pipeline.md
+++ b/docs/guides/sdlc-pipeline.md
@@ -1019,7 +1019,7 @@ All three keys (`tests_globs`, `code_globs`, `docs_globs`) are optional. Unset k
 
 The conflict-resolver role's allow list is the union of all three glob lists, so any of these keys also widens what the conflict-resolver can write.
 
-**Security boundary:** Security-relevant blocklists (`.egg-state/contracts/`, `.github/`) are hard-coded and cannot be relaxed by repo config. Only the language-convention globs are configurable.
+**Security boundary:** Security-relevant blocklists (`.egg-state/` — up to the whole tree for the coder/tester tier — and `.github/`) are hard-coded and cannot be relaxed by repo config. Only the language-convention globs are configurable.
 
 The orchestrator pre-resolves the override at spawn time and passes it to sandbox containers via the `EGG_PIPELINE_REPO_PATTERNS_JSON` environment variable. The gateway reads the override directly from `repositories.yaml` at push time. Validation behavior differs slightly between paths: `config/repo_config.py::get_repo_role_patterns` (the orchestrator/gateway path that reads `repositories.yaml`) emits a WARNING log on invalid root type, unknown keys, non-list values, and non-string list entries; `shared/egg_restrictions/patterns.py::load_repo_pattern_override` (the env-var path used inside the sandbox) only logs on invalid JSON and silently filters the rest. In practice the operator still sees diagnostic warnings at orchestrator spawn time because the orchestrator runs `get_repo_role_patterns` before serializing into the env var.
 
diff --git a/docs/reference/agent-roles.md b/docs/reference/agent-roles.md
index 8346120f2d..410c2e4b0a 100644
--- a/docs/reference/agent-roles.md
+++ b/docs/reference/agent-roles.md
@@ -717,7 +717,7 @@ The gateway's `get_attributed_changed_files_in_push()` walks the unpushed range
 
 For the exact allowed and blocked patterns per role, see `shared/egg_restrictions/patterns.py` (canonical source). The gateway imports from this shared package for push-time validation.
 
-**Per-repo overrides (#2528):** The test/code/docs glob lists described above are the *defaults*. Repositories with non-Python file conventions (Go, JS/TS, etc.) can override them via a `role_patterns:` block in `repositories.yaml`. Only the language-convention globs (`tests_globs`, `code_globs`, `docs_globs`) are configurable; security-relevant blocklists (`.egg-state/contracts/`, `.github/`) are hard-coded and cannot be relaxed. See [Per-Repository Role Patterns](../guides/sdlc-pipeline.md#per-repository-role-patterns) for the configuration schema.
+**Per-repo overrides (#2528):** The test/code/docs glob lists described above are the *defaults*. Repositories with non-Python file conventions (Go, JS/TS, etc.) can override them via a `role_patterns:` block in `repositories.yaml`. Only the language-convention globs (`tests_globs`, `code_globs`, `docs_globs`) are configurable; security-relevant blocklists (`.egg-state/` — up to the whole tree for the coder/tester tier — and `.github/`) are hard-coded and cannot be relaxed. See [Per-Repository Role Patterns](../guides/sdlc-pipeline.md#per-repository-role-patterns) for the configuration schema.
 
 ## Per-Agent Git Identity
 
diff --git a/shared/egg_restrictions/patterns.py b/shared/egg_restrictions/patterns.py
index 5da4fb75c4..685d4b8b5d 100644
--- a/shared/egg_restrictions/patterns.py
+++ b/shared/egg_restrictions/patterns.py
@@ -162,8 +162,10 @@ def _normalize_path(file_path: str) -> str:
 # are the load-bearing language conventions. Repos can override them via
 # ``role_patterns:`` in ``repositories.yaml`` so non-Python conventions
 # (Go ``*_test.go``, JS ``__tests__/``, etc.) get correct role boundaries.
-# Security-relevant blocklists (``.egg-state/contracts/``, ``.github/``)
-# are NOT overridable — they enforce the policy boundary independent of
+# Security-relevant blocklists (the whole ``.egg-state/`` tree for the
+# coder/tester tier, ``.egg-state/contracts/`` — plus ``.egg-state/reviews/``
+# for plan agents — for the other roles, and ``.github/``) are NOT
+# overridable — they enforce the policy boundary independent of
 # repo-specific conventions.
 
 # Default test-file conventions: directory patterns + file-name patterns.
@@ -952,10 +954,12 @@ def build_agent_patterns(
         A fresh dict mapping role name to ``AgentFilePattern``.
 
     Security note:
-        Security-relevant blocklists (``.egg-state/contracts/``,
-        ``.github/``, etc.) are sourced from this module's hard-coded
-        builders and CANNOT be overridden by a repo's config. The
-        per-repo knobs only widen the language-convention lists.
+        Security-relevant blocklists (the whole ``.egg-state/`` tree for
+        the coder/tester tier, ``.egg-state/contracts/`` — plus
+        ``.egg-state/reviews/`` for plan agents — for the other roles, and
+        ``.github/``) are sourced from this module's hard-coded builders and
+        CANNOT be overridden by a repo's config. The per-repo knobs only
+        widen the language-convention lists.
     """
     if repo is not None and tests_globs is None and code_globs is None and docs_globs is None:
         override = load_repo_pattern_override(repo)