dingtalk-pat

PAT Behavior Authorization Skill

🧪 EXPERIMENTAL · Experimental / Preview — multi mode currently does not meet the stable standard. All dingtalk-* skills have passed the dispatch verifier, but interfaces, naming, and cross-skill references may be adjusted later; for production / shared environments, prefer mono mode (dws skill setup --mode mono). Please file an issue to report problems.

PREREQUISITE: Read the dws-shared skill first for auth, global flags, product routing, Schema discovery, error handling, and safety rules. The dws binary must be on PATH.

Command Reference:pat.md。

Intent Table

User says	Command
"Allow / prohibit opening the browser during PAT authorization"	dws pat browser-policy --enabled / dws pat browser-policy --enabled=false
"Preview the behavior authorization for a product or scope"	dws pat chmod ... --dry-run --format json
"Grant one-time / session / permanent behavior permission"	dws pat chmod ...; preview and confirm first, then add --yes to execute

Security Boundaries

• browser-policy only modifies the local policy and does not grant business permissions.
• chmod changes the Agent's executable scope. First use --dry-run to show the scope, authorization type, and validity period, and only after obtaining the user's explicit confirmation may you add --yes。
• PAT behavior authorization is not open platform app permission; the latter uses dws dev app permission, and switch to dingtalk-dev。