When we use CROS_WORKON_SUBTREE, a list for directories which are not accessible is created and passed to the sandboex.

However, the sandbox uses simple prefix match of a path, so it sometimes misunderstands it.
For example,

if we have;

platform2/foo/bar
platform2/foo/bar2

and, in a pacakge, platform2/foo/bar2 is added to CROS_WORKON_SUBTREE,
then platform2/foo/bar is passed to sandbox. It denies to access files starting with platform2/foo/bar, which includes platform2/foo/bar2.
That's unexpected behavior.