Workspaces, permissions and safety

Design the boundary

Create a dedicated working directory, limit the task to it and use Git before allowing writes. A workspace is not a complete security guarantee: review which tools the active profile can actually invoke.

git status
git switch -c dsh/controlled-test
git add -A && git commit -m "State before DSH"

Operating rules

Define in advance what the agent may read, write, execute and communicate. Irreversible or external actions need a human approval.

• Keep secrets out of prompts, logs and screenshots.
• Do not connect production during early tests.
• Review the diff before accepting changes.
• Stop the session when it leaves the stated goal.