DSCC
home / guides / permissions

Permissions

DSCC gates every tool call through a permission mode. Modes are defined at crates/runtime/src/permissions.rs:4–23.

Modes

Mode Aliases Level
ReadOnly read-only, default, plan Reads only
WorkspaceWrite workspace-write, acceptEdits, auto Writes inside cwd
DangerFullAccess danger-full-access, dontAsk Unrestricted
Prompt prompt Ask for each call
Allow allow Silently allow all

Decision logic

From permissions.rs:88–135:

  1. If current mode ≥ required mode → allow.
  2. If current mode is Allow → allow.
  3. If current mode is Prompt → prompt.
  4. If current is WorkspaceWrite and required is DangerFullAccess → prompt.
  5. Otherwise → deny.

Per-tool requirements

Each tool declares a required mode via PermissionPolicy.tool_requirements: BTreeMap<String, PermissionMode> (permissions.rs:50–73). The default fallback for unknown tools is DangerFullAccess.

How to set the mode

Ordered from least to most local (higher wins on conflict):

Source Example
settings.permissions.defaultMode Global or project settings file
DSCC_PERMISSION_MODE env var export DSCC_PERMISSION_MODE=workspace-write
--permission-mode CLI flag dscc --permission-mode read-only prompt ...
/permissions <mode> Change mode mid-session

See also