Is there a way to not default-allow read access to the whole system?

I'm using [Nix](https://nixos.org) for local dev environments and because of that I know exactly what paths our local dev environment *should* have access to . I'd like to write a `settings.json` like the following (generated by nix package manager):

```
{
"permissions": {
"deny": [
"Read(//**)"
],
"allow": [
"Read(//nix/store/0837wpkjb27cr70bi3pc4g2rw5v9r63l-openssl-3.5.2/)",
"Read(//nix/store/0ja5daq2yay3svg6f48spyfby7pgy5bm-xgcc-14.3.0-libgcc/)",
"Read(//nix/store/7ndy5820h69n1pgd13viph1qjq6zhhkj-libunistring-1.3/)",
"Read(//nix/store/bqis2a16pk7hs360yc7m7zh7x2wlaia6-nginx-1.28.0/)",
"Read(//nix/store/i3fhvaqr01y17rzmlc6flwfmr7cmglfn-libxslt-1.1.43/)",
"Read(//nix/store/jij3abyhf88b2wb9s6gds7x74lcw88zl-zlib-ng-2.2.5/)",
"Read(//nix/store/nkn950vf2i29k4v3z6w9717pjrg483ng-libxcrypt-4.4.38/)",
"Read(//nix/store/qhw0sp183mqd04x5jp75981kwya64npv-glibc-2.40-66/)",
"Read(//nix/store/wqlkv0cjacnm7arca156p3d3vh0kdbmk-pcre2-10.46/)",
"Read(//nix/store/wwqyxsvmg41q5ckfvvv6wa50nwvz9dv4-libidn2-2.3.8/)",
"Read(//nix/store/yw9ks7f8sx384yw37xrsqdxn2ljw2d1y-libxml2-2.14.6/)"
]
}
}
```

But this doesn't work because denies override allows.

Is there a way to opt out of the default read-only allow all paths rule?