diff --git a/cfg/backends/kiro-cli.yaml b/cfg/backends/kiro-cli.yaml
index 448d718..a9e7c48 100644
--- a/cfg/backends/kiro-cli.yaml
+++ b/cfg/backends/kiro-cli.yaml
@@ -1,5 +1,7 @@
 # Kiro backend requirements
 filesystem:
+  rox:
+    - "{HOME}/.local/bin"
   rw:
     - "{HOME}/.kiro"
     - "{HOME}/.aws"
diff --git a/cfg/global.yaml b/cfg/global.yaml
index 85fe42c..c423457 100644
--- a/cfg/global.yaml
+++ b/cfg/global.yaml
@@ -30,7 +30,9 @@ filesystem:
         - /etc/ld.so.cache
         - /etc/host.conf
         - /etc/gai.conf
+        - /etc/os-release
         - /proc
+        - /sys
         - '{XDG_CONFIG_HOME}/anvillm'
         - '{HOME}/env'
     rox:
diff --git a/cfg/roles/default.yaml b/cfg/roles/default.yaml
index 5856b52..77939d9 100644
--- a/cfg/roles/default.yaml
+++ b/cfg/roles/default.yaml
@@ -1,10 +1,11 @@
 # Default role: permissive settings for ad-hoc usage
 # Equivalent to current global sandbox.yaml behavior
 filesystem:
-  rw:
+  rwx:
     - "{CWD}"
+    - "{PLAN9}/bin"
+  rox:
+    - "{HOME}/bin"
+    - "{HOME}/.local/bin"
 network:
   unrestricted: true
-env:
-  - ANTHROPIC_API_KEY
-  - KIRO_API_KEY