{
  "name": "readonly",
  "version": "1.0.0",
  "description": "Read-only policy — allows reading from project directory, blocks all writes, network, and exec.",
  "defaultPermission": "deny",
  "filesystem": [
    {
      "path": "./**",
      "operations": ["read"],
      "permission": "allow"
    },
    {
      "path": "/tmp/**",
      "operations": ["read", "write"],
      "permission": "allow"
    }
  ],
  "network": [],
  "exec": [],
  "envAllowlist": ["NODE_ENV", "PATH", "HOME"],
  "auditLogPath": "./audit.log"
}