{
  "permissions": {
    "defaultMode": "dontAsk",
    "allow": [
      "Read(//**)",
      "Glob(//**)",
      "Grep(//**)",
      "Edit(//**)",
      "Write(//**)",
      "Bash(git status *)",
      "Bash(git diff *)",
      "Bash(git add *)",
      "Bash(git log *)",
      "Bash(git show *)",
      "Bash(git ls-remote *)",
      "Bash(git fetch *)"
    ],
    "deny": [
      "Bash(git commit *)",
      "Bash(git push *)",
      "Bash(sudo *)",
      "Bash(nixos-rebuild *)",
      "Bash(nix build *)",
      "Bash(nix flake check *)",
      "Bash(ssh *)",
      "Bash(agenix *)",
      "Bash(scripts/deploy-pinix.sh *)",
      "Edit(.git/**)",
      "Write(.git/**)"
    ]
  }
}