Here's the set of new deny flags, which have higher precedence over allow flags:

--deny-env=

--deny-sys=

--deny-hrtime

--allow-net=

--deny-ffi=

--deny-read=

--deny-run=

--deny-write=