Governing sudo: VS Code Copilot and Privilege Escalation

Correction note (2026-10-13). The per-call timings and latency figures that appeared in this article had no benchmark behind them and were removed. Sample output in this article is illustrative, not a recorded run. The only published measurement is p50 0.39 ms and p99 1.91 ms (sigmashake-bench daemon-socket run, 2026-06-10, ssg 0.29.156, n=500). Sub-2 ms evaluation is a design target.

Correction note (2026-10-13). An earlier version of the rule in this article used an env EQUALS "CI" condition. The rule DSL has no env field, so the rule did not load. The rule now has no environment condition; place it in the rules directory that CI uses.

Describe the task

VS Code Copilot is setting up a development environment. It installs a system package using sudo:

sudo apt-get install -y libpq-dev

SSG intercepts the privilege escalation and routes it to the human approval queue before the install runs.

# illustrative sample output
[ASK] bash › sudo apt-get install -y libpq-dev — rule: ask-sudo
Waiting for human approval...

Give SSG context

SSG evaluates VS Code Copilot's shell commands via the SSG MCP Server integration.

Required context

rule ask-sudo {
  enabled true
  priority 90
  severity warning
  ASK execution
  IF command STARTS_WITH "sudo"
  MESSAGE "sudo command requires human approval. Verify the package and reason before allowing."
  PROMPT "Allow this sudo command to run?"
}

Optional context

Block sudo entirely in CI environments. The rule DSL has no environment field, so scope the rule by where it is installed: put this file in the .sigmashake/rules/ directory your CI runners use, not on developer machines:

rule deny-sudo-ci {
  enabled true
  priority 100
  severity error
  DENY execution
  IF command STARTS_WITH "sudo"
  MESSAGE "sudo is blocked in CI. Use pre-built Docker images with required system packages."
}

What SSG does

SSG pauses the tool call and surfaces it in the approval queue. The package is not installed until explicitly approved — giving you full visibility into system-level changes your agents are making.

Ask the agent to use containerized dependencies

sudo apt-get was escalated for approval. Consider alternatives:
  - Add the system dependency to your Dockerfile
  - Use a pre-built developer container with the package included
  - Use a language-level package manager (pip, npm, bundler) if a native binding exists
  - Use nix-shell for reproducible dev environments without sudo

Allowlist known safe packages

For packages you regularly approve, add a higher-priority ALLOW rule:

rule allow-sudo-libpq {
  enabled true
  priority 200
  severity info
  ALLOW execution
  IF command EQUALS "sudo apt-get install -y libpq-dev"
  MESSAGE "Pre-approved system dependency."
}

Audit privilege escalations over time

Review ssg dashboard for all sudo commands — both approved and blocked. Unusual escalation patterns (packages being installed at unexpected times) can indicate agent confusion or compromise.