diff --git a/plugos/environments/deno_sandbox.ts b/plugos/environments/deno_sandbox.ts
index 64dc26e..028cae0 100644
--- a/plugos/environments/deno_sandbox.ts
+++ b/plugos/environments/deno_sandbox.ts
@@ -46,7 +46,24 @@ export function createSandbox(plug: Plug<any>) {
     workerHref,
     {
       type: "module",
-    },
+      deno: {
+        permissions: {
+          // Allow network access and servers (main use case: fetch)
+          net: true,
+          // This is required for console loggin to work, apparently?
+          env: true,
+          // No talking to native code
+          ffi: false,
+          // No invocation of shell commands
+          run: false,
+          // No read access to the file system
+          read: false,
+          // No write access to the file system
+          write: false,
+        },
+      },
+      // Have to do this because the "deno" option is not standard and doesn't typecheck yet
+    } as any,
   );
   return new Sandbox(plug, new DenoWorkerWrapper(worker));
 }