{
  "_comment": "UNVERIFIED ON WINDOWS. Path-matching syntax for permission rules was confirmed on macOS only. Before the first client session, test on a Windows machine that a denied command is actually refused - see run sheet step 9b. Do not assume this file is enforcing anything until you have watched it refuse something.",
  "permissions": {
    "allow": [
      "Bash(powershell*bus.ps1*)",
      "Bash(dir*)",
      "Bash(mkdir*)",
      "Read(~/work/**)",
      "Write(~/work/**)",
      "Edit(~/work/**)"
    ],
    "deny": [
      "Bash(curl*)",
      "Bash(Invoke-WebRequest*)",
      "Bash(Invoke-RestMethod*)",
      "Bash(ssh*)",
      "Bash(scp*)",
      "Bash(net user*)",
      "Bash(reg *)",
      "Bash(schtasks*)",
      "Bash(del *)",
      "Bash(Remove-Item*)",
      "Bash(icacls*)",
      "Bash(claude*)",
      "Read(~/.config/jym-bus/**)",
      "Read(~/.claude/**)",
      "Write(~/.claude/**)",
      "Write(~/bin/**)",
      "Write(~/.config/**)",
      "WebFetch"
    ]
  }
}