Permissions and sandbox

An agent that runs commands and edits files needs limits. DeepSeek Harness applies them with two mechanisms that are worth keeping apart, because they are configured separately.

The first is the isolation mode, and it answers how far an operation reaches when it runs.

• Read only read-only Grants no write access anywhere
• Workspace workspace-write Writes inside the project folder and in a temporary area
• Unrestricted danger-full-access Turns confinement off entirely

The second is the approval policy, and it answers whether you get asked before it acts.

Out of the box they come paired into two named options.

Option	Isolation	Approval
The normal one	workspace-write	asks first
The other one	full access	never asks

Technical detail optional

Each setting has its own event and its own write method. If the active values match no combination in the table, the state shows as custom, which is a derived value and not an option you can switch to.

The most interesting part of the design

If the system cannot guarantee confinement, it does not run.

That sounds obvious and it almost never is. The habit in software is to degrade quietly: if the isolation mechanism is unavailable, run without it and move on. Here that is explicitly forbidden in the documentation. Either it returns an execution that genuinely confines, or it fails with an identifiable error.

There is a second detail along the same line. The degree of isolation is a fact the system reports, not an assumption. It can tell you that it governs every effect it promises, or that it only governs part of them. Old versions of the Linux mechanism and certain limits of the Windows implementation fall into the second case today.

A system that warns you when it cannot give you the full guarantee is more useful than one that pretends it always can.

The other way of doing it

It is worth seeing the contrast, because there is an opposite school and it is honest too.

Pi, Earendil’s minimal harness, does not include a permission system. Its own documentation says so in those words, and points you to containerising from the outside with a Linux micro VM, with Docker or with a policy sandbox. Its argument is that half confinement inside the process gives a false sense of security, and that real isolation lives one layer down.

DeepSeek Harness picks the opposite: confine inside, and fail closed when it cannot. Neither of them pretends, and that is the part that matters. Section 21 comes back to this.

What this does not cover

Isolation talks about files. The network and process visibility fall outside that vocabulary, and the documentation says so plainly.