Good question! We use the Deno (https://deno.land) runtime which comes with built it permissions mgmt