GPR-006 · critical risk
Review destructive shell commands
Require review before supported shell execution reaches a destructive command family.
Decision
review
Matcher
command = rm
Reviewed
2026-08-09
Safe test cases
matching synthetic case
command = rm → review
different benign synthetic case
command = benign-rm → unmatched
Limitations
- This is an exact command-family guard, not a complete shell sandbox.
Review before applying
This recipe is a starting point, not a universal security policy. Open it in Policy Studio, replace example identifiers where necessary, review scope and blast radius, simulate where supported, and use the normal approval flow before enforcement.
Recipe SHA-256: 92ac9bac8fa99a3d2024fb96e60b28560ccdcffbb409c8dc7043de07399a7f97
When a policy is saved and delivered through Guard Cloud, it uses the existing Guard policy-bundle compiler. If the policy-bundle signing key is configured, that compiler produces an RSA-PSS-SHA256 signed bundle that local Guard verifies before applying.