---
title: "Windows deny-read 用精确目录"
filename: "~/.codex/config.toml"
canonical: /templates/windows-deny-read-exact/
---

# Windows deny-read 用精确目录

不要写 Chrome/**。目录 deny 覆盖子树，避免 glob 展开撑爆沙箱 helper。

```
default_permissions = "managed_net"

[permissions.managed_net]
extends = ":workspace"

[permissions.managed_net.filesystem]
glob_scan_max_depth = 3
":workspace_roots" = { "." = "write" }
"~/AppData/Local/Google/Chrome" = "deny"
"/absolute/path/to/secrets" = "deny"

```