configs/policy.readonly.json

{
  "root": ".",
  "permissions": ["READ"],
  "commands": {},
  "timeout_seconds": 30,
  "output_limit": 12000,
  "max_file_bytes": 200000,
  "allow_host_execution": false
}