People will use the equivalent of audit2allow https://linux.die.net/man/1/audit2allow and not go the extra mile of defining fine-grained capabilities to reduce the attack surface to a minimum.
{
"permissions": {
"allow": [
"Bash(bash:*)",
],
"deny": []
}
}