Approval, policy, and permission presets
Separate one-shot human decisions, session policy, and sandbox mode into orthogonal controls
preset = sandbox knob + approval knobWhy does danger-full-access plus never-ask still not mean every tool can execute?
Access zones, whether to call an administrator, and prohibited-item rules are separate systems. A permission preset bundles the first two for convenience; it cannot erase hard prohibitions.
Mechanism
ctx.approval returns allowed-once, rejected, cancelled, or unavailable for one exact action. Every outcome except allowed-once fails closed. ApprovalPolicy is ask or never.
PermissionPreset writes sandbox/mode and approval/policy through their authoritative setters. current() derives from actual folded knobs and reports custom when no preset matches.
Select preset
Record permission/preset user intent.
What extensions must preserve
- unavailable must deny
- allowed-once authorizes only the current operation
- Presets do not enforce; they compose authoritative knobs
The tempting wrong turns
- ×Interpreting never as auto-allow
- ×Duplicating tool arguments into an approval prompt and letting them drift
- ×Persisting custom as a selectable preset
Do not trust the conclusion—verify it
These anchors are pinned to official deepseek-harness@47f9438; account for later breaking changes when reading current upstream.
docs/subsystems/approval.mdOutcome vocabulary, policy, audit pair, and fail-closed behavior.
docs/subsystems/permission-presets.mdPresets and orthogonal knobs.
packages/interaction/user-approval/src/index.tsAuthoritative waterfall implementation.
Pause for ten seconds before revealing
Why does an answerer failure not retry or default-allow?
Approval decides whether to proceed; sandbox and capability seams decide where and what the action may affect.