[capabilities]

Top-level capabilities bucket. Mirrors [capabilities.allow.*] and [capabilities.deny.*] one-for-one.

Sub-pages

Sub-section	Page
[capabilities.allow]	capabilities.allow — Grants the agent can use: reads, writes, commands, network, extra directories.
[capabilities.deny]	capabilities.deny — Hard blocks that override every allow.