# Permissions

The plugin reuses Harness sandbox and approval primitives. Its classifications are:

- **SAFE:** read, search, inspect, non-destructive diagnostics.
- **WORKSPACE:** edit project files, run project commands, start local servers.
- **SENSITIVE:** database migrations, external writes, git push, deployment, environment changes.
- **DANGEROUS:** production data deletion, infrastructure destruction, protected-history force push, credential rotation, repository deletion.

V0.1 adds an approval-aware pre-execute gate for common shell/Supabase/job names. It delegates to the native `approval` Service when available and fails closed when approval is unavailable; it never grants, replaces, or bypasses Harness approval. The current code intentionally does not register Supabase mutation tools; if another composition does, those names must remain behind the native approval flow.

Secrets remain outside model context. Repository content and command output are untrusted. Path containment, shell sandboxing, destructive-command policy, and explicit approval belong to the native Harness rows.