{
  "permissions": {
    "allow": [
      "Read(file_path:/etc/passwd)",
      "Bash(npm:*)",
      "WebFetch(domain:good.com)"
    ],
    "deny": [
      "Bash(command:rm *)",
      "Grep(path:/secrets)",
      "Agent(model:opus)"
    ],
    "ask": [
      "WebFetch(url:http://evil.com)"
    ]
  }
}