The needs header

It must be the first thing in a file. A file without one has no permissions at all.

needs [
  read  [./src, ./tests],
  write [./src],
  run   ["npm test", "git add", "git commit"],
  net   [],
]

• Keys: read, write, run, net, env, clock, random.
• A missing key means none. net [] says it out loud, and a reviewer sees that an empty bracket means no network.
• Paths are bare (./src) and stay inside the folder the script was started in unless the person grants more.
• Trailing commas and free whitespace inside brackets are fine.

Tip

sub explain and the run prompt print the block back in plain words, so a person approves meaning, not syntax.

Reading it

Line	Means
read [./src, ./tests]	read files and list folders under these two paths
write [./src]	create, change and delete files under ./src
run ["git commit"]	start git commit, nothing else
net []	no network at all

See Permissions for every key and the subset rule.