具体例：managed-settings.json（設計イメージ）

permissions の deny ＋ allowManagedPermissionRulesOnly ＋ disableBypassPermissionsMode で“外せない禁止”を作る、概念例です。

{
  "permissions": {
    "deny": [
      "Read(**/.env)", "Read(**/secrets/**)",
      "Read(~/.ssh/**)",
      "Bash(sudo *)", "Bash(rm -rf *)",
      "Bash(git push --force *)"
    ],
    "ask": ["Bash(curl *)", "Bash(wget *)"],
    "allow": ["Bash(npm test *)", "Bash(npm run lint *)"]
  },
  "allowManagedPermissionRulesOnly": true,
  "disableBypassPermissionsMode": "disable"
}

※ allowManagedPermissionRulesOnly:true で user/project の permission rules は無効化される。