Ability to tightly constrain which files must or may be read or edited

We'd like to be able to pass in list of glob patterns (e.g. bla.txt or **/boop.md etc) that tell claude which file paths

• _must be edited_
• _may be edited_
• _may be created_
• _may be read_ (or perhaps in that case may _not_ - like .cursorignore)
• _must be read_ (meaning they are always included in the context

Our specific usecase is non-interactive, so it'd be great if this could be passed in via CLI