The permission descriptor for the allow-write and deny-write permissions, which controls access to writing to resources from the local host. The option path allow scoping the permission to a specific path (and if the path is a directory any sub paths).

Permission granted under allow-write only allows runtime code to attempt to write, the underlying operating system may apply additional permissions.