An allow-run or deny-run permission can be scoped to a specific executable, which would be relative to the start-up CWD of the Deno CLI.