my-homelab-configs/infra/agent-sandbox/policy.tsv

1	pattern	decision	reason
2	./jeannie status	allow	Read-only health report.
3	./jeannie doctor-	allow	Read-only focused doctor command.
4	./jeannie capacity	allow	Read-only capacity report.
5	./jeannie validate	allow	Read-only repository validation.
6	./jeannie safety-case	allow	Read-only change safety review.
7	./jeannie incident	allow	Read-only incident triage/replay.
8	./jeannie ai-evals	allow	Read-only eval harness.
9	./jeannie prompt-injection-lab	allow	Read-only security lab harness.
10	./jeannie start-cluster	allow	Idempotent recovery path that starts saved Kubernetes services and worker VMs without destroying state.
11	./jeannie up	approval	High-blast-radius deployment.
12	./jeannie apps	approval	Application deployment can mutate cluster state.
13	./jeannie rpi-services	approval	Mutates RPi Docker services.
14	./jeannie nuke	deny	Destructive cluster state path.
15	tofu destroy	deny	Destructive infrastructure path.
16	terraform destroy	deny	Destructive infrastructure path.
17	rm -rf	deny	Destructive file deletion pattern.
18	kubectl delete	approval	Kubernetes deletion needs explicit scope and approval.
19	docker rm	approval	Docker deletion needs explicit scope and approval.