Thanks. I was sure someone was going to make this sooner rather than later and this one seems relatively easy to configure.

I got tired of setting individual allow lists for each CLI, hopefully now I can run them all in Yolo mode while fence does the centralized sandboxing.