{
  "permissions": {
    "allow": ["Agent(model:sonnet)", "WebFetch(domain:good.com)", "Bash(npm:*)"],
    "deny": ["Agent(model:opus)", "WebFetch(domain:evil.com)", "Bash"]
  }
}