Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add rules/mr-chen-05/rules-2.1-optimized/permission-control-systemgit clone --depth 1 https://github.com/Mr-chen-05/rules-2.1-optimizedWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/mr-chen-05/rules-2.1-optimized/permission-control-system)<a href="https://agentmods.dev/rules/mr-chen-05/rules-2.1-optimized/permission-control-system"><img src="https://agentmods.dev/badge/rules/mr-chen-05/rules-2.1-optimized/permission-control-system.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.02532 | $0.02532 |
| Opus 5 | $0.01266 | $0.01266 |
| Sonnet 5 | $0.00506 | $0.00506 |
| Haiku 4.5 | $0.00253 | $0.00253 |
Grade A, and why
permission-control-system scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 343 lines — stays where its author put it; the contents beside it link to each section on GitHub.
🔐 权限控制系统
第1层 - 核心身份定义
三角色权限模型
主要角色:
1. User (用户) - 项目所有者或维护者
2. AI (AI助手) - 智能开发助手或代理
3. System (系统) - 底层系统或管理员
第2层 - 权限分配矩阵
User (用户) 权限
读权限:
- 读取所有区块内容 (Pinned/Decisions/TODO/Done/Notes)
- 读取归档文件
- 读取操作日志和审计日志
权限等级: 完全读权限
写权限:
- 添加/编辑 Pinned 条目
- 添加/编辑 Notes 备注
- 编辑已有的任何条目
权限等级: 高级写权限
删除权限:
- 标记条目为"已过期"或"已弃用"
- 清理临时备忘录
- 无法完全删除Pinned/Decisions/Done条目
权限等级: 受限删除权限
执行权限:
- 执行 /archive 命令
- 执行 /sync 同步操作
- 执行 /rollback 回滚操作
- 执行 /export 导出操作
权限等级: 管理权限
审批权限:
- 审批AI的操作
- 确认敏感信息脱敏
- 认可关键决策记录
权限等级: 审批权限
AI (AI助手) 权限
读权限:
- 读取所有区块内容
- 读取完整的历史记录
- 读取配置和元数据
权限等级: 完全读权限
写权限 (追加模式):
- 追加 Pinned 条目 (需用户确认关键内容)
- 追加 Decisions 决策记录
- 追加 TODO 任务
- 追加 Done 已完成项
- 追加 Notes 备注
权限等级: 受限写权限 (仅追加)
修改权限 (受限):
- 修改日期戳 (标记生效期间)
- 标记条目为 "已过期"
- 更新优先级
- 添加关联标签
权限等级: 低级修改权限
删除权限:
- 完全禁止删除任何条目
- 无删除权限
权限等级: 无删除权限
执行权限:
- 执行 /record 增量记录
- 执行 /sync-memory 同步记忆
- 建议执行 /archive (需用户确认)
权限等级: 受限执行权限
操作限制:
- 不能访问系统配置
- 不能修改权限规则
- 不能执行危险操作
- 所有操作需要记录审计
权限等级: 沙箱隔离
System (系统) 权限
读权限:
- 读取所有内容和元数据
- 读取系统日志
权限等级: 完全读权限
写权限:
- 修改任何内容
- 编辑系统配置
权限等级: 完全写权限
删除权限:
- 删除任何内容
- 执行物理删除
权限等级: 完全删除权限
执行权限:
- 执行所有命令
- 执行维护操作
- 执行恢复操作
权限等级: 完全执行权限
第3层 - 操作权限详细定义
项目记录文件 (project.context.md) 操作权限
区块权限矩阵:
Pinned区块:
User: 创建/读/追加 ✅ | 修改日期 ✅ | 标记过期 ✅ | 删除 ❌
AI: 读 ✅ | 追加(需确认) ⚠️ | 修改日期 ❌ | 标记过期 ❌ | 删除 ❌
System: 所有操作 ✅
Decisions区块:
User: 读 ✅ | 追加 ✅ | 编辑已有 ✅ | 删除 ❌
AI: 读 ✅ | 追加 ✅ | 编辑 ❌ | 删除 ❌
System: 所有操作 ✅
TODO区块:
User: 读 ✅ | 创建 ✅ | 编辑 ✅ | 标记完成 ✅ | 删除 ❌
AI: 读 ✅ | 创建 ✅ | 更新优先级 ✅ | 标记完成 ❌ | 删除 ❌
System: 所有操作 ✅
Done区块:
User: 读 ✅ | 追加 ✅ | 查看 ✅ | 删除 ❌
AI: 读 ✅ | 追加 ✅ | 删除 ❌
System: 所有操作 ✅
Notes区块:
User: 读 ✅ | 创建 ✅ | 编辑 ✅ | 删除 ✅
AI: 读 ✅ | 追加 ✅ | 编辑 ❌ | 删除 ❌
System: 所有操作 ✅
第4层 - 操作审计系统
审计日志格式
审计日志文件: .context-audit-log
日志条目结构:
{
"timestamp": "2025-01-31T14:30:00Z",
"actor": "user|ai|system",
"action": "append|modify|mark_expired|archive|sync",
"target": "Decisions#D001",
"target_section": "section_name",
"old_value": "previous content (if applicable)",
"new_value": "new content",
"reason": "user_input|auto_archive|maintenance",
"status": "success|failed",
"error_message": "error details if failed",
"ip_address": "user_ip (if available)",
"session_id": "session_identifier"
}
审计日志保留:
- 最少保留3个月
- 最多保留12个月
- 按月份分割文件
- 定期压缩归档
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 343 lines · 2,532 tokens per session scan A c465e4e18a0e
permission-control-system is a cursor rule published in the GitHub repository Mr-chen-05/rules-2.1-optimized (172 stars, last pushed 10mo ago), licensed MIT. It adds 2,532 tokens to every session, about $0.0127 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other cursor rules, from other repositories
angular-20
This rule provides comprehensive best practices and coding standards for Angular development, focusing on modern TypeScript, standalone components, signals, and performance optimizations.
dev-standard
Apache Superset development standards and guidelines for Cursor IDE.
cli-error-handling
CLI command error handling patterns.
family-instance-domain-actions
Family instance domain action implementation patterns.
prefer-assertions-over-defensive-checks
Prefer assertions over defensive checks when data is guaranteed to be valid.
prefer-direct-imports-over-module-mocks
Prefer extracting a testable core over vi.mock / vi.resetModules when unit tests need to reach production logic entangled with config, env, or singletons.