but I don't want to give them access to write to the fs, open network connections