The permission descriptor for the allow-run and deny-run permissions, which controls access to what sub-processes can be executed by Deno. The option command allows scoping the permission to a specific executable.

Warning, in practice, allow-run is effectively the same as allow-all in the sense that malicious code could execute any arbitrary code on the host.