What a plugin is allowed to touch — enforced by starting its Deno subprocess with exactly the matching --allow-net/--allow-read/--allow-write flags and nothing wider (lanrurugi_plugin::pool::Worker::spawn), constitution Principle IV. Declaring less than a plugin actually needs fails loudly at the call site (a denied fetch/file op throws); there is no way to request "read access to one specific file" here beyond PluginInfoResult.sidecar_files, which the host resolves itself rather than granting real filesystem access for.