# Permissions
allow:
  - "read:source"
  - "read:docs"
  - "read:templates"
  - "read:non_secret_config"
  - "git:status"
  - "git:diff"

ask:
  - "git:commit"
  - "git:push"
  - "deploy:*"
  - "read:large_logs_for_runtime_errors"

restricted:
  - "live_secret_files"
  - "runtime_environment_dumps"
  - "credential_stores"
  - "shell_history"
  - "credential_value_searches"
  - "credential_discovery_commands"
  - "destructive_terminal_commands"