Deno.RunPermissionDescriptor - Deno documentation
interface Deno.RunPermissionDescriptor

The permission descriptor for the allow-run and deny-run permissions, which controls access to what sub-processes can be executed by Deno. The option command allows scoping the permission to a specific executable.

Warning, in practice, allow-run is effectively the same as allow-all in the sense that malicious code could execute any arbitrary code on the host.

Properties

name: "run"
optional
command: string | URL

An allow-run or deny-run permission can be scoped to a specific executable, which would be relative to the start-up CWD of the Deno CLI.