[
  {
    "note": "empty grant set denies everything but implicit Cpu",
    "grants": {
      "compute": {
        "devices": [
          "Cpu"
        ],
        "energy_budget_uj": 0,
        "cpu_time_ms": 0,
        "memory_bytes": 0
      },
      "storage": {
        "read": [],
        "write": [],
        "delete": []
      },
      "network": {
        "outbound": [],
        "inbound": false
      },
      "kv": {
        "read": false,
        "write": false,
        "prefixes": []
      },
      "host": {
        "logging": false,
        "clock": false,
        "random": false,
        "inference": false
      },
      "process": {
        "exec": false,
        "programs": [],
        "max_processes": 0
      },
      "browser": {
        "enabled": false,
        "origins": [],
        "headless": false
      },
      "display": {
        "enabled": false,
        "vnc": false,
        "max_width": 0,
        "max_height": 0
      }
    },
    "queries": [
      {
        "kind": "dispatch",
        "arg": "Cpu",
        "expect": true
      },
      {
        "kind": "dispatch",
        "arg": "Gpu",
        "expect": false
      },
      {
        "kind": "read",
        "arg": "/x",
        "expect": false
      },
      {
        "kind": "egress",
        "arg": "api.example.com:443",
        "expect": false
      },
      {
        "kind": "host",
        "arg": "Inference",
        "expect": false
      },
      {
        "kind": "exec",
        "arg": "python",
        "expect": false
      },
      {
        "kind": "navigate",
        "arg": "https://example.com",
        "expect": false
      },
      {
        "kind": "display",
        "arg": "",
        "expect": false
      }
    ]
  },
  {
    "note": "populated grant set allows exactly what it names",
    "grants": {
      "compute": {
        "devices": [
          "Cpu",
          "Gpu"
        ],
        "energy_budget_uj": 1000000,
        "cpu_time_ms": 1000,
        "memory_bytes": 1073741824
      },
      "storage": {
        "read": [
          "/work/**"
        ],
        "write": [
          "/work/out/*"
        ],
        "delete": []
      },
      "network": {
        "outbound": [
          "api.example.com:443"
        ],
        "inbound": false
      },
      "kv": {
        "read": false,
        "write": false,
        "prefixes": []
      },
      "host": {
        "logging": false,
        "clock": false,
        "random": false,
        "inference": true
      },
      "process": {
        "exec": true,
        "programs": [
          "python"
        ],
        "max_processes": 0
      },
      "browser": {
        "enabled": true,
        "origins": [
          "https://example.com"
        ],
        "headless": false
      },
      "display": {
        "enabled": true,
        "vnc": false,
        "max_width": 0,
        "max_height": 0
      }
    },
    "queries": [
      {
        "kind": "dispatch",
        "arg": "Gpu",
        "expect": true
      },
      {
        "kind": "dispatch",
        "arg": "Tpu",
        "expect": false
      },
      {
        "kind": "read",
        "arg": "/work/a",
        "expect": true
      },
      {
        "kind": "write",
        "arg": "/work/a",
        "expect": false
      },
      {
        "kind": "write",
        "arg": "/work/out/r",
        "expect": true
      },
      {
        "kind": "egress",
        "arg": "api.example.com:443",
        "expect": true
      },
      {
        "kind": "egress",
        "arg": "api.example.com:80",
        "expect": false
      },
      {
        "kind": "host",
        "arg": "Inference",
        "expect": true
      },
      {
        "kind": "exec",
        "arg": "python",
        "expect": true
      },
      {
        "kind": "exec",
        "arg": "bash",
        "expect": false
      },
      {
        "kind": "navigate",
        "arg": "https://example.com",
        "expect": true
      },
      {
        "kind": "navigate",
        "arg": "https://evil.com",
        "expect": false
      },
      {
        "kind": "display",
        "arg": "",
        "expect": true
      },
      {
        "kind": "vnc",
        "arg": "",
        "expect": false
      }
    ]
  }
]