Use case · Data and backups
Keep backup jobs from deleting the backups they protect
Route backup retention, prune, and purge commands through review so a bad cron entry or a hallucinated cleanup cannot erase recovery points.
Backup tooling is dangerous in both directions: a restore you never want to skip, and a prune or purge that silently removes the copies you will need. The catalog documents destructive operations for four widely used backup tools, each with critical-severity review defaults.
Evidence grade: reviewed catalog facts · Last reviewed 2026-09-12
Every step below references coverage documented in the HOL Guard extension catalog. These workflows are derived from reviewed catalog facts, not independently run or benchmarked — verify the result in your own setup before relying on it.
When this is not the right fit
Skip this workflow if
- Your backup tool is not rclone, restic, Borg, or Velero — the catalog documents destructive operations for these tools only.
- The job moves data through object-storage CLIs rather than a backup tool — the object-storage workflow covers that surface.
Prerequisites
Before you start
- Guard is installed on the machine that runs the backup jobs.
- You know which backup CLIs your schedules invoke.
Steps
The workflow
- 1
Review rclone data removal
The rclone entry reviews deletion, purge, move, and synchronization operations that can remove data (rclone delete, deletefile, purge, rmdirs, sync, move).
- 2
Review restic snapshot and repository removal
The restic entry reviews snapshot forgetting, repository pruning, and rewrite operations that remove originals (restic forget, prune, rewrite --forget).
- 3
Review Borg archive deletion and pruning
The Borg entry reviews archive deletion, retention pruning, and archive recreation (borg delete, prune, recreate). The catalog lists --help, --dry-run, and -n as safe variants.
- 4
Review Velero backup and restore-record deletion
The Velero entry reviews deletion of backups, schedules, and restore records through the Velero CLI (velero backup delete, schedule delete, restore delete).
Expected result
What the documented coverage should do
Retention and cleanup commands that match the reviewed mutation operations pause for review before they run. A documented dry-run variant such as --dry-run for Borg is not affected by this coverage, and the workspace policy decides the response mode for everything else.
Limitations
What this workflow does not claim
- The catalog documents these four backup tools; other backup software has no documented operations here.
- Coverage is limited to the reviewed operations and the surrounding Guard policy, per the catalog’s stated limitations.
Coverage referenced
Extensions in this workflow
- Rclone command protectioncommand.backup.rclone
- Restic command protectioncommand.backup.restic
- Borg command protectioncommand.backup.borg
- Velero command protectioncommand.backup.velero