dsh-agent-policy

When agent-registry, session-permissions, and agent-gate all live in the same DSH workspace, each plugin tends to interpret policy fields slightly differently. Over time those dialects pile up and debugging a permission question turns into a cross-plugin scavenger hunt. dsh-agent-policy extracts the shared contract for governance Phase 1-2 into a single installable plugin: one policy schema, one set of preset base classes, one MCP initialization default, and one policy version identifier. Every other plugin reads from the same definition instead of maintaining its own copy.

Three capabilities stand out. First, the schema contract gives every plugin an identical vocabulary for field names, allowed values, and versioning rules, removing ambiguity at the source. Second, the MCP init policy offers three presets - none, explicit, and init-defaults - so a freshly created Claw Agent starts with a well-defined MCP surface; servers.allow and servers.deny let you pin the exact service names that are visible at boot. Third, the preset templates (research, developer, etc.) provide reusable starting configurations that land in ~/.dsh/agent-policy/defaults.json and apply to every subsequent Agent creation of that role.

What this plugin explicitly does not do is intercept tool calls. All real rejection and hiding logic lives in dsh-agent-gate. Removing dsh-agent-policy will not loosen any permission; the system simply falls back to DSH's original permission-presets. It is designed for DSH administrators building multi-Agent workspaces who need a consistent policy vocabulary across plugins and role-based MCP surfaces out of the box.