No sites were agreed as "off limits." There is no clause in the agreement saying that any are. When negotiating the deal, there was, of course, noise and bluster, mostly from politicians looking to score points with their bases about that, but there was never any kind of site that was declared to be off limits, and Iran never refused access to any sites requested by the IAEA. After Trump took office, and they made noise about wanting unfettered access to all their military sites, without any evidence that there was reason to suspect nuclear activity, of course Iran pushed back, as any sovereign nation would. If Iran demanded access to US military sites, nuclear and not, we'd laugh at such a request.
There were sites that were agreed that the IAEA would have unfettered access to, and agreements for a process for them to get access to other sites, if they showed cause to investigate.
The agreement allows for a "long-term IAEA presence in Iran" to monitor materials and nuclear development that wouldn't be used in weapons. Inspectors will have continuous monitoring capabilities at known nuclear facilities like Fordow fuel enrichment plant and the Natanz enrichment facility. For other areas in the country, including military sites where there is suspected nuclear activity, IAEA inspectors will have to request access.
If inspectors have concerns that Iran is developing its nuclear capabilities at any of the non-official nuclear sites, they are allowed to request access "for the sole reason to verify the absence of undeclared nuclear materials and activities or activities inconsistent with" the agreement. They must also inform Iran of the basis for their concerns.
Iran, in response, can propose alternatives to inspection that might satisfy the IAEA's concerns, the deal says. But if they can't come to an agreement to satisfy the inspectors within 14 days of the original request for access, the issue goes to a joint commission that consists of representatives from the P5+1 powers (the U.S., China, Russia, France, the United Kingdom and Germany), Iran, and the European High Representative for Foreign Affairs. They have another seven days to reach an agreement that must be supported at least five of the eight members. If they decide inspectors should get access, Iran has three days to provide it.
CBS News: Obama says inspectors get access to "any" site in Iran. Is it true?
The thing is, even if Iran had months of time, they couldn't hide a nuclear program. The equipment and infrastructure are too heavy-duty to be thrown into a truck and hauled away, and you're dealing with material that leaves traces for hundreds of thousands of years.
In the agreement, Iran gave access that was more intrusive than any nation had ever agreed to before, and they lived up to their end of the agreement.
It said the Vienna-based U.N. nuclear watchdog was able to carry out all so-called complementary access inspections needed to verify Iran’s compliance with the deal.
“Timely and proactive cooperation by Iran in providing such access facilitates implementation of the Additional Protocol and enhances confidence,” said the report, which was distributed to IAEA member states.
“The production rate (of enriched uranium) is constant. There is no change whatsoever,” a senior diplomat added.
Reuters - Iran is complying with nuclear deal restrictions: IAEA report