lol yeah, but mostly just want to allow more types of reads for getting context, and primarily for test running / linting etc. I shouldn't have to approve every invocation of `pytest` or `bazel test`.

--dangerously-bypass-approvals-and-sandbox isn't enough for you?

I don't want unlimited writes. I basically want to unlock nearly everything but approve writes in some scenarios.

Where do unix permissions and a different user and extended attributes fall short for that?