Should path restrictions use --allow-read= prefix or runtime permission queries for file access?

Path Restriction vs Runtime Queries for File System Access

Deno's file system permission model offers two distinct approaches for restricting read access to specific directories. The command-line flag --allow-read=/path restricts access at startup, while Deno.permissions.query() and Deno.permissions.request() enable dynamic checks during execution.

The constraint involves balancing security posture with application flexibility. Flag-based restrictions provide immediate enforcement but cannot adapt to runtime conditions. Dynamic queries allow conditional access patterns but require explicit error handling when permissions are denied.

For applications needing to access files across multiple directories conditionally, the trade-off centers on whether to grant broad flags with runtime validation or precise flags with potential access failures. Third-party modules may require broader permissions than anticipated, complicating granular flag usage.

Which approach better supports applications that must conditionally grant file access based on user input or configuration, while maintaining minimal privilege principles?

• Does flag-based path restriction break when modules expect broader access than explicitly granted paths?
• Can runtime permission queries be effectively used without repetitive error handling for each file operation?
• How do Windows and Unix-like systems differ in their handling of path-restricted read permissions?