The permission descriptor for the
deny-write permissions, which
controls access to writing to resources from the local host. The option
path allow scoping the permission to a specific path (and if the path is
a directory any sub paths).
Permission granted under
allow-write only allows runtime code to attempt
to write, the underlying operating system may apply additional permissions.