PermissionHandler.approveSafety

[kawax]

PermissionHandler.approveAll is too permissive. Also add PermissionHandler.approveSafety, excluding high-risk kinds.

• shell, write: deny
• other kinds: approve

[github-actions]

Thanks for opening this issue!

I've labeled this as an enhancement and security since you're proposing a safer permission handler that mitigates risk by denying shell and write operations by default.

This would be a useful addition to complement PermissionHandler.approveAll, providing developers with a more secure default option for production use cases where unrestricted permissions aren't needed.

AI generated by Issue Triage Agent

[IeuanWalker]

@kawax in the permission handler you can write your own logic to auto approve stuff you deam safe

[SteveSandersonMS]

Thanks @IeuanWalker. That is the intended approach.