Use case · Data and backups

Keep backup jobs from deleting the backups they protect

Route backup retention, prune, and purge commands through review so a bad cron entry or a hallucinated cleanup cannot erase recovery points.

Backup tooling is dangerous in both directions: a restore you never want to skip, and a prune or purge that silently removes the copies you will need. The catalog documents destructive operations for four widely used backup tools, each with critical-severity review defaults.

Evidence grade: reviewed catalog facts · Last reviewed 2026-09-12

Every step below references coverage documented in the HOL Guard extension catalog. These workflows are derived from reviewed catalog facts, not independently run or benchmarked — verify the result in your own setup before relying on it.

When this is not the right fit

Skip this workflow if

  • Your backup tool is not rclone, restic, Borg, or Velero — the catalog documents destructive operations for these tools only.
  • The job moves data through object-storage CLIs rather than a backup tool — the object-storage workflow covers that surface.

Prerequisites

Before you start

  • Guard is installed on the machine that runs the backup jobs.
  • You know which backup CLIs your schedules invoke.

Steps

The workflow

  1. 1

    Review rclone data removal

    The rclone entry reviews deletion, purge, move, and synchronization operations that can remove data (rclone delete, deletefile, purge, rmdirs, sync, move).

    Rclone command protectionTry this coverage Coverage details
  2. 2

    Review restic snapshot and repository removal

    The restic entry reviews snapshot forgetting, repository pruning, and rewrite operations that remove originals (restic forget, prune, rewrite --forget).

    Restic command protectionTry this coverage Coverage details
  3. 3

    Review Borg archive deletion and pruning

    The Borg entry reviews archive deletion, retention pruning, and archive recreation (borg delete, prune, recreate). The catalog lists --help, --dry-run, and -n as safe variants.

    Borg command protectionTry this coverage Coverage details
  4. 4

    Review Velero backup and restore-record deletion

    The Velero entry reviews deletion of backups, schedules, and restore records through the Velero CLI (velero backup delete, schedule delete, restore delete).

    Velero command protectionTry this coverage Coverage details

Expected result

What the documented coverage should do

Retention and cleanup commands that match the reviewed mutation operations pause for review before they run. A documented dry-run variant such as --dry-run for Borg is not affected by this coverage, and the workspace policy decides the response mode for everything else.

Limitations

What this workflow does not claim

  • The catalog documents these four backup tools; other backup software has no documented operations here.
  • Coverage is limited to the reviewed operations and the surrounding Guard policy, per the catalog’s stated limitations.

Coverage referenced

Extensions in this workflow