initialCard:
      lowerBound:
        positive:
          - "env(?agent) @ ?agent : read : GOLEM_AGENT_ID"
          - "env(?agent) @ ?agent : read : GOLEM_COMPONENT_ID"
          - "env(?agent) @ ?agent : read : GOLEM_COMPONENT_REVISION"
          - "env(?agent) @ ?agent : read : GOLEM_AGENT_TYPE"
          - "tool(?component/knife) @ ?agent : invoke : *"
          - "filesystem(?agent) @ ?agent : read : /**"
          - "filesystem(?agent) @ ?agent : stat : /**"
          - "filesystem(?agent) @ ?agent : list : /**"
          - "filesystem(?agent) @ ?agent : * : /workspace/**"
      upperBound:
        negative:
          - "filesystem(?agent) @ ?agent : write : /protected/**"
          - "filesystem(?agent) @ ?agent : delete : /protected/**"