I can't get these disk restrictions to work. 1) I granted full disk access to iTerm2. Later I removed them in the UI and I can still do everything in iTerm. 2)

I can't get these disk restrictions to work. 1) I granted full disk access to iTerm2. Later I removed them in the UI and I can still do everything in iTerm. 2) I have "Documents" granted to a Java app. Tried opening or saving a file in various locations and didn't notice any restriction other than my ordinary UNIX user's 3) I created an app bundle containing a plain shell script that reads my firefox cookie file and curls the file somewhere. This app runs just fine with no prompt whatsoever. Am I being stupid here or what's up?