Policy
Destack supports configuring the policy that controls which host actions some piece of code - like a module or some dependency - may perform. Packages declare the actions and resources they require, and the app or workspace decides which requirements are allowed.
1{2 "policy": {3 "requires": [4 { "action": "fs.read", "resource": "app://config/**" },5 { "action": "net.connect", "resource": "tcp://database.internal:5432" }6 ],7 "rules": [8 {9 "subject": { "package": "app" },10 "action": "fs.read",11 "resource": "app://config/**",12 "access": "allow"13 },14 {15 "subject": { "package": "@vendor/parser" },16 "action": "net.connect",17 "resource": "*",18 "access": "deny"19 }20 ]21 }22}