[andolanra]

One thing you can do is explicitly revoke permissions. This allows you to start the program with more permissions and then give them up as the tasks that required them are done, e.g. allowing environment variable access at the beginning and then revoking it before you start a server: https://deno.land/manual/examples/permissions

It's not as fine-grained as allowing libraries specific permissions, but it gets you part of the way there.