Permission Units Are Exact

Bash Is the Operator

Structured file tools are realpath-fenced under declared roots. bash is not. Argument inspection of a shell line is advisory. The real permission unit is the exact command string, hashed, and the operator's answer to that hash. Allowing 'npm' is not a unit. Allowing one concrete line is. A later line that differs by a flag is a new ask.

An interactive tool is its own permission. ask offers two to eight labelled options, at most one recommended, and resolves through the same Asker seam a dangerous command uses. The operator's answer is the authority. Nothing else executes. Plan approval is the same seam, addressed from the durable plan entry so a graphical client can park on it.

A permission that matches a family of commands is a story. A permission that matches one hash is a decision. The record stores decisions.

Deny Is a Teaching Signal

When bash is denied, a competent local model makes the refused attempt once and recovers with fenced file tools. That was measured. Deny is not a failed run. It is a recorded no that steers the next call. Hidden stripping — advertising a tool and then removing it — would teach the model it succeeded without the tool it needed.

UNIT hash of the exact command line NOT A UNIT a binary name, a prefix, a 'looks safe' regex ASK 2-8 options, same Asker seam as bash DENY a recorded no; the next call may recover STRIP advertising a tool then removing it — refused

Bash Is the Operator

Deny Is a Teaching Signal

Code

External links

Exercise

Progress

Comments 0