Claude Code ran terraform destroy on the live stack

You were in Claude Code. It decided the stack was wrong and ran terraform destroy. No saved plan. No human confirm in the chat. If that finishes, the managed resources in that workspace go away: databases, networks, the stuff your app still needs.

HOL Guard froze the teardown. Two buttons on screen: Allow just this once or Keep blocked. Until you tap Allow, destroy has not started.

Keep blocked leaves the destroy stopped. The receipt stays on your machine.

Why destroy is not a cleanup shortcut

terraform destroy is intentional teardown of managed infrastructure. Agents reach for it when a prompt says "reset the env," when a plan failed halfway, or when the session confuses a sandbox workspace with prod. You never typed destroy. The session still gets the CLI.

Other Extensions cover the next step. If the agent then wipes an S3 bucket through the AWS CLI, that is cloud AWS coverage. If it tries to clear the pause itself, that is command.guard-self-protection. This Extension only claims infrastructure-as-code teardown through Terraform, OpenTofu, and Pulumi.

What Guard maps

Built-in Infrastructure-as-code protection (command.infrastructure-as-code, v1.0.0, Core safety). It has one operation, Infrastructure teardown, severity Critical, reviewed by default. Permission ID: command.infrastructure-as-code.permission.destroy. It identifies infrastructure-as-code commands that destroy managed resources. Safe variants in the catalog include command help and Pulumi destroy preview.

Catalog example: terraform destroy.

A workspace can tighten this to block or loosen the floor, unless a managed-restrictive Control Set pins the Extension. The catalog default is not your fleet policy.

On Protect / Extensions, leave posture at Protected unless you have a deliberate reason to Watch. Watch will not stop the teardown.

Out of scope

command.infrastructure-as-code does not cover:

• Non-destroy Terraform / OpenTofu / Pulumi flows (plan, apply of non-destroy changes, help) when they are not the reviewed teardown operation.
• Cloud CLI resource deletion outside IaC tools: command.cloud.aws, command.cloud.azure, command.cloud.gcp, and related Extensions.
• Recursive filesystem deletes: command.filesystem.
• An agent calling hol-guard approvals approve on itself: command.guard-self-protection.
• Package installs and one-shot runners: Package Firewall Extensions.

How do I stop Claude Code from running terraform destroy?

Install HOL Guard, keep command.infrastructure-as-code at Protected, then check it without tearing anything down. command test and command explain do not run the command, create an approval, or write a receipt.

hol-guard command test 'terraform destroy'
hol-guard command explain 'terraform destroy'
hol-guard command controls show command.infrastructure-as-code
hol-guard command extensions

Run the test again after an upgrade. If it says unrecognized, confirm the Extension is current and posture is not Watch.

After Inbox lights up

This pause is for IaC teardown that can destroy managed resources. A plain terraform plan is not this operation.

Change the permission in Protect / Extensions or from the CLI. For a team floor that local auto-approve cannot weaken, pin a managed-restrictive Control Set on command.infrastructure-as-code.permission.destroy.

If you meant the destroy, choose Allow just this once after you know which workspace, account, and region are selected. If you did not, Keep blocked and ask which prompt pushed for teardown. The receipt stays local. Cloud sync is optional and does not carry the raw command.

Background: HOL Guard 3.0.