GPR-010 · high risk
Block a dangerous tool
Block a named tool after a security review determines that it should not execute.
Decision
block
Matcher
tool = dangerous-tool
Reviewed
2026-08-09
Safe test cases
matching synthetic case
tool = dangerous-tool → block
different benign synthetic case
tool = benign-dangerous-tool → unmatched
Limitations
- Use an exact reviewed tool identifier; broad wildcard blocking is intentionally not represented.
Review before applying
This recipe is a starting point, not a universal security policy. Open it in Policy Studio, replace example identifiers where necessary, review scope and blast radius, simulate where supported, and use the normal approval flow before enforcement.
Recipe SHA-256: f71e12efc3d042f5779fa4d53e0367f6a35dc848e7a578c60b63ed9260abb381
When a policy is saved and delivered through Guard Cloud, it uses the existing Guard policy-bundle compiler. If the policy-bundle signing key is configured, that compiler produces an RSA-PSS-SHA256 signed bundle that local Guard verifies before applying.