GPR-018 · critical risk
Block a reviewed destructive command
Block a specific destructive command family after confirming it is unsafe for the target workspace.
Decision
block
Matcher
command = mkfs
Reviewed
2026-08-09
Safe test cases
matching synthetic case
command = mkfs → block
different benign synthetic case
command = benign-mkfs → unmatched
Limitations
- Command aliases, scripts, and equivalent operations require separate controls.
Review before applying
This recipe is a starting point, not a universal security policy. Open it in Policy Studio, replace example identifiers where necessary, review scope and blast radius, simulate where supported, and use the normal approval flow before enforcement.
Recipe SHA-256: 9cd009fc31b9ebfa3590825c3362c1f0805dc70bdb5cf93af191026ddb8dc831
When a policy is saved and delivered through Guard Cloud, it uses the existing Guard policy-bundle compiler. If the policy-bundle signing key is configured, that compiler produces an RSA-PSS-SHA256 signed bundle that local Guard verifies before applying.