{
  "action": "block",
  "emergencyEligible": true,
  "id": "GPR-018",
  "limitations": [
    "Command aliases, scripts, and equivalent operations require separate controls."
  ],
  "matcher": {
    "kind": "command",
    "value": "mkfs"
  },
  "reviewedAt": "2026-08-09",
  "risk": "critical",
  "schemaVersion": "guard-policy-recipe/v1",
  "slug": "block-workspace-destructive-command",
  "summary": "Block a specific destructive command family after confirming it is unsafe for the target workspace.",
  "templateId": "limit-destructive-shell-commands",
  "tests": [
    {
      "expected": "block",
      "label": "matching synthetic case",
      "matcherKind": "command",
      "value": "mkfs"
    },
    {
      "expected": "unmatched",
      "label": "different benign synthetic case",
      "matcherKind": "command",
      "value": "benign-mkfs"
    }
  ],
  "threatSlugs": [
    "prompt-injection"
  ],
  "title": "Block a reviewed destructive command"
}