Treat presets as starting points, not guarantees

The documented workspace-write plus ask pattern keeps routine work inside the workspace and retains approval boundaries for escalation. A danger-full-access plus never-ask composition removes important friction and should be reserved for isolated environments where the consequence is understood.

  • read-only: inspection without workspace writes.
  • workspace-write: changes inside the intended workspace.
  • danger-full-access: broad filesystem consequence.
  • approval policy: determines whether escalation is surfaced to the user.

Filesystem sandbox is not the entire system boundary

Network access and process execution have their own policies and consequences. A plugin that cannot write outside the workspace may still send data over the network if network access is allowed. A command-line tool can affect external systems through credentials even when local writes are constrained.

Telemetry is opt-in, but the mode matters

Official documentation says telemetry is disabled by default. Opt-in modes can include messages, tool arguments/results, files, and paths depending on the selected mode; API keys are structurally excluded. Review the current documentation before opting in and avoid treating structural key exclusion as a promise that every other sensitive value is absent.

Third-party plugins and Skills extend trust

A plugin runs code inside the harness environment. A Skill supplies instructions and can reference scripts. Review source identity, build steps, configuration, network/file/process needs, and update behavior before enabling either. A successful install and a clean topic tag are not security reviews.

A practical low-risk first session

Use a disposable or version-controlled workspace, workspace-write sandbox, explicit approvals, only the required network target, one known model credential, no unreviewed plugin, and a small read-only first task. Inspect the diff before broadening permissions.

Direct permission tests still required

HarnessBase will exercise filesystem attempts under each sandbox, approval prompts, network/process boundaries, and telemetry payload shapes before converting this page into an indexable tested matrix.

Sources and evidence boundary

Primary sources establish product facts. HarnessBase labels direct testing separately and does not convert community observations into verified results.

Target query cluster: DeepSeek Harness security · DeepSeek Harness permissions · DeepSeek Harness sandbox · DeepSeek Harness telemetry