Ha, well now I look like a shill installed in the audience. Nice though, I'll give that a go, thanks.
It's probably manageable through direnv & some shell magic, but it'd be nice to have a built-in way of saying 'everything in this directory gets run through phylum [with these defaults] and has access to only this directory [by default]'.