policy:
  default_mode: confirm
  resources:
    filesystem: confirm
    shell: confirm
    sql: confirm
    mcp: confirm
    external_models: confirm
    desktop: confirm
    browser: confirm