{
  "network": {
    "allowedDomains": [],
    "allowAllUnixSockets": true
  },
  "filesystem": {
    "denyRead": [
      "/run/user",
      "/run/dbus",
      "/run/docker.sock",
      "/run/podman",
      "/run/tailscale",
      "/run/ssh-unix-local",
      "/tmp/.X11-unix",
      "/tmp/tmux-*",
      "/tmp/ssh-*",
      "/tmp/*/SingletonSocket"
    ],
    "allowRead": [
      "~/.hermes"
    ],
    "allowWrite": [
      "~/.hermes"
    ]
  }
}