dsh-permission-matrix: DeepSeek Harness Permission Matrix Plugin

Introduction¶

Permission control in DeepSeek Harness (DSH) is usually concentrated in a few fixed tiers. The dsh-permission-matrix plugin splits permissions into two independent dimensions: sandbox (read/write boundaries) and approval (how operations are approved), and recombines them into 9 switchable presets. It retains the core approach (rules + LLM judge + hard deny), but expands the preset table into a full combination matrix, supporting risk tiering and audit.

Core Features¶

The plugin combines 3 sandbox modes with 4 approval strategies to generate 9 execution types.

9 Presets¶

ID	Display Name	Sandbox	Approval	Behavior
`ro-human`	Workspace read-only permission + manual approval	read-only	ask	Writes are rejected by the sandbox; out-of-scope operations trigger a manual confirmation prompt
`ro-deny`	Workspace read-only permission + automatic denial	read-only	never	All writes are denied; there is no approval stage
`ww-human`	Workspace read/write permission + manual approval	workspace-write	ask	Writes are allowed inside the workspace; out-of-scope operations trigger a manual confirmation prompt (default)
`ww-classify`	Workspace read/write permission + automatic risk approval	workspace-write	ask	Writes are allowed inside the workspace; out-of-scope and high-risk operations are adjudicated by risk tier
`ww-deny`	Workspace read/write permission + automatic denial	workspace-write	never	Writes are allowed inside the workspace; out-of-scope operations are always denied
`fa-human`	Full system read/write permission + manual approval	danger-full-access	ask	All file operations are allowed; operations requiring approval are sent to manual approval
`fa-deny`	Full system read/write permission + automatic denial	danger-full-access	never	All file operations are allowed; operations requiring approval are always denied
`fa-auto`	Full system read/write permission + automatic consent	danger-full-access	ask	All file operations are allowed; operations requiring approval are automatically allowed (hard-deny protection)
`fa-classify`	Full system read/write permission + automatic risk approval	danger-full-access	ask	All file operations are allowed; operations are adjudicated by risk tier

Risk Tiering Strategy¶

The plugin defines four risk tiers: Low, Medium, High, and Extreme. The evaluation order is:

Hard deny: denied by default (cannot be approved by a human); when the Extreme tier is configured as ask or password, it switches to a password-approval channel.
High risk: non-drive-root recursive / bulk deletion and ordinary git push fall under this tier; paths inside the workspace are exempt.
Workspace-internal structural allow: write operations whose target is inside the session workspace, excluding protected targets (e.g., ~/.dsh, credentials).
Allow rules: regular git, package manager queries, language runtimes, etc.
LLM judge: toggleable semantic adjudication.
Four-tier policies: apply the corresponding Low/Medium/High/Extreme policy based on risk level (values can be allow/deny/ask/password).

The Extreme policy does not support allow. The Low-tier policy can be set to password.

Password Approval¶

“Password approval” is the fourth approval mode, alongside allow/deny/manual approval. When the policy is set to password, the operation is suspended, and this plugin prompts for the approval password. If the input is correct, it is executed immediately; if the input is incorrect or times out, it is treated as denied.

Passwords are stored as scrypt hashes (N=16384, r=8, p=1); plaintext is never written to disk. If no password is set, all password policies are denied. Once approved, a one-time token bound to the fingerprint is issued.

Other Features¶

Audit log: JSONL format, recording the outcome of each adjudication.
Git snapshots: automatically create a git snapshot before allowing; throttling is supported.
Robot support: social channel sessions can use an independent default preset (robotDefaultPreset), matched by workspace.

Installation and Activation¶

Ensure the environment meets Node >= 20. The installation command is as follows:

dsh plugin --profile <profile> add dsh-permission-matrix

Note: If dsh-auto-classifier is also installed, disable it; the two will contend for the same permission entry.

# <profile>/cordis.patch.yml
- id: auto-classifier
  name: dsh-auto-classifier
  disabled: true
  config: { enabled: false, presetName: auto }

Configuration¶

Configure it in the settings page or the permission-matrix entry in cordis.patch.yml:

enabled: master switch, default true.
takeover: preset mapping, e.g., { "default": "ww-human" }.
riskPolicies: four-tier policies, e.g., {low: "allow", medium: "deny", high: "deny", hard: "deny"}.
approvalPasswordHash: scrypt hash for setting the approval password (written by the settings page; not in the writable whitelist).
approvalPasswordTtlMs: password approval window, default 300000ms.
llmJudge: LLM judge switch, default true.
robotDefaultPreset: default preset for robot sessions, default fa-auto.
robotWorkspaces: workspace list for robot sessions, default empty.
auditLog: audit switch, default true.
auditFile: audit file path, default ~/.dsh/permission-matrix/audit.jsonl.

Invalid configuration (e.g., setting the Extreme tier to allow) causes a loud failure at load time.

Audit¶

The plugin records a JSONL line for each decision, including fields such as time, session ID, preset, tool, target, risk, rule, source, decision, and result.

Architecture and Testing¶

The plugin implements its functionality through three hooks: tools/pre-execute, approval/request, and session/created. Core logic includes decision making, rule matching, password approval, LLM judge, Git snapshots, and audit.

Tests cover 69 cases, including hard deny, high-risk dispatch, workspace-internal exemptions, chained execution bypass, false-blocking regressions, four-tier policies, and password-approval end-to-end scenarios.

Summary¶

This plugin provides fine-grained permission control for DSH, suitable for production environments that require strict auditing and risk tiering. By splitting sandbox and approval dimensions, it offers a more flexible configuration approach than a single preset.