What it is — This plugin delivers declarative permission rules for DeepSeek Harness, using ordered allow/deny/ask YAML to match tool names, arguments, workspace paths, and agent identity on the tools/pre-execute waterfall, with full audit, dry-run, and hot reload.
Who it is for — When you want to restrict agent tool calls in DeepSeek Harness based on specific rules for names, params, paths, and identity, this plugin is suitable. If your workflows do not require such matching rules or session logging, you do not need to install it, as another angle is that it is designed for complex permission scenarios involving multiple decision layers.
Watch out — Sandbox testing passed after installation in a fresh profile and registration with harness. Static checks indicate it can execute shell commands, but this is only a hint, not a defect. No obvious runtime issues were found.
The verdict — I would install it because the rules-first approach paired with AI reviewer backstop allows deterministic decisions before model involvement, providing a value in auditable tool execution control.