DeepSeek Harness Permissions and Sandboxing Explained (2026)

DeepSeek-Harness (dsh) controls what an agent can actually do through two independent layers: a sandbox mode (what the OS-level execution environment permits) and an approval policy (whether the agent asks before acting). New sessions default to workspace-write sandboxing with ask approval — full access with no prompts is available, but it's not the default, and one place it does show up by default deserves a closer look below.

The three sandbox modes

Mode	What it allows
`read-only`	No writes at all. POSIX backends additionally allow writing to `/dev/null` specifically.
`workspace-write`	Writes confined to the session's workspace root plus platform-appropriate temp directories. Network access and process visibility are not restricted by this mode. This is the default for new sessions.
`danger-full-access`	No isolation whatsoever.

Note the gap in workspace-write: it constrains the filesystem, not the network or what processes the agent can see. A workspace-write session can still make arbitrary outbound network calls.

Sandbox backends, by platform

Enforcement of these modes is implemented differently per platform, and the enforcement strength isn't uniform everywhere:

Platform	Backend
Linux	bwrap / Landlock
macOS	Seatbelt
Windows	ACL-based restricted tokens (`dsh-sandbox-windows-acl`)
Cloud (optional)	E2B cloud sandbox (`packages/e2b`) — swaps the execution environment for a remote isolated container instead of local process sandboxing

Older Landlock ABI versions and the Windows ACL backend can only achieve partial enforcement, not full — the docs explicitly require consumers to distinguish between these two enforcement levels rather than treating every backend as equally strong. If you're evaluating dsh for a security-sensitive use case, that distinction matters more than the mode name alone.

Permission presets: pairing sandbox mode with approval policy

A permission preset bundles a sandbox mode with an approval policy into one named option surfaced to clients (ctx.permissionPresets). The default table has exactly two entries:

workspace-write:
  sandbox: workspace-write
  approval: ask        # prompts before write/exec actions outside the sandbox's allowance

danger-full-access:
  sandbox: danger-full-access
  approval: never       # never asks — full access, no prompts

You can define additional custom presets in configuration; the name custom itself is reserved and can't be reused for one of your own. This is a cordis.patch.yml-level change — see Configuration Guide for how to add a row without accidentally wiping other settings on it, since overrides replace a target row's config wholesale rather than merging it.

DSH_PERMISSION_MODE overrides the process-level fallback for which preset a new session starts under — see CLI Cheat Sheet for the full environment variable table.

Where `danger-full-access` shows up by default — and why that matters

The Web UI's minimal-prompt path and interactive sessions default to workspace-write + ask. But the Python SDK's own example code wires up danger-full-access by default:

from deepseek_harness import DeepSeekHarness

with DeepSeekHarness(
    provider="deepseek-official",
    model="deepseek-v4-flash",
    max_tokens=49_152,
    cwd=str(workspace),
    session_root=str(sessions),
    cordis=str(config),
) as harness:
    result = harness.run("Inspect the repository and fix the failing tests.", session_id="example-001")

The docs pair this example with an explicit warning: it should only be run in a one-off checkout or a container, precisely because it's unsandboxed by default. If you're wiring dsh into a script, CI job, or any programmatic pipeline via the SDK, check what sandbox mode you're actually running under — don't assume the SDK inherits the Web UI's safer default, because it doesn't out of the box.

Approval policy: the other half of a preset

Sandboxing constrains what an action is capable of doing at the OS level; approval policy decides whether the harness pauses to ask a human before it does that action at all. The two default presets sit at opposite ends of that axis: workspace-write pairs a moderately constrained sandbox with ask — the agent stops and waits for a yes/no before write or exec actions that fall outside its allowance. danger-full-access pairs zero isolation with never — nothing is confirmed, ever.

There's a middle ground the two-entry default table doesn't show by name but that custom presets can express: a more permissive sandbox with ask still on, or a tightly scoped sandbox with approvals turned off because the blast radius is already small enough not to matter. If you're defining your own preset in cordis.patch.yml, treat sandbox mode and approval policy as genuinely separate dials, not a single "how much do I trust this session" slider — a session with unrestricted network access and no filesystem writes is a very different risk profile from one with full filesystem writes and no network.

Enforcement strength isn't uniform

The docs are explicit about two known gaps: older Landlock ABI versions on Linux and the Windows ACL restricted-token backend can only achieve "partial" enforcement, not "full" — and consumers are expected to distinguish the two rather than treat every backend as equally strong. The source material doesn't spell out a complete full/partial matrix for every backend and platform version, so don't assume macOS Seatbelt or E2B are automatically "full" in every configuration just because they aren't named alongside the two documented partial cases — verify against your actual OS/kernel version if the distinction matters for your threat model.

"Partial" isn't a footnote to skim past — it means the sandbox can be bypassed or has gaps that full enforcement closes. If you're deploying dsh on Windows or an older Linux kernel for anything beyond personal, trusted use, budget time to understand exactly what "partial" leaves open on that specific backend, and treat "sandboxed" as a spectrum on those platforms rather than a binary guarantee.

Practical checklist

Know your default. Interactive sessions (Web UI, headless CLI) start workspace-write + ask. SDK example code does not — verify explicitly.
Don't conflate workspace-write with "safe from network exfiltration." It restricts the filesystem, not outbound network calls.
Check enforcement strength, not just the mode name, on Windows and older Linux kernels — partial enforcement is a real, documented gap.
danger-full-access has its place (disposable containers, one-off checkouts) but should never be the default for a session touching a real machine or real credentials.
Third-party plugins execute code on your machine at install time too, independent of the runtime sandbox — see the allowBuilds discussion in How to Install DeepSeek-Harness Plugins for why a permission preset alone doesn't cover install-time risk.
If you want a local, read-only audit of what's actually configured — sandbox settings, plugin origins, session state, network exposure — dsh-security-audit in Development & Runtime runs exactly this kind of check and produces a redacted risk report.

FAQ

Is `workspace-write` enough to safely run an untrusted plugin?

Not by itself. It confines filesystem writes, but network access is unrestricted under workspace-write, and installing a plugin in the first place can execute code outside any runtime sandbox entirely (see the allowBuilds mechanism). Sandboxing the running agent and vetting what you install are separate concerns.

Does `read-only` mode allow the agent to run any commands at all?

The docs describe read-only as disallowing writes, with POSIX backends additionally permitting writes to /dev/null specifically. Read operations and non-writing commands are the intended use case for this mode.

Why does the Windows sandbox backend matter for enforcement strength?

The ACL-based restricted-token approach on Windows is documented as achieving only partial enforcement, not full — the same distinction applies to older Landlock ABI versions on Linux. Treat "sandboxed" as a spectrum on these platforms rather than a binary guarantee.

For a broader operational checklist around running dsh with other people — shared machine-level config, telemetry, and plugin policy — see Running DeepSeek Harness in a Team. Before installing anything, How to Vet a DeepSeek Harness Plugin Before You Install It covers the install-time risks that sandboxing alone doesn't address. Browse audit and diagnostic tooling in Development & Runtime or the full plugin catalog.