sandbox_mode = "workspace-write"
approval_policy = "on-request"