Conservative permissions with deny rules

{
  "model": "claude-sonnet-4-6",
  "permissions": {
    "allow": [
      "Read",
      "Edit",
      "Glob",
      "Grep",
      "Bash(npm run test)",
      "Bash(npm run build)",
      "Bash(git *)"
    ],
    "deny": [
      "Bash(npm publish *)",
      "Bash(git push --force*)",
      "Bash(docker system prune*)"
    ]
  }
}