my-homelab-configs/infra/agent-sandbox/policy.tsv

1	pattern	decision	reason
2	./jeannie status	allow	Read-only health report.
3	./jeannie doctor-	allow	Read-only focused doctor command.
4	./jeannie capacity	allow	Read-only capacity report.
5	./jeannie validate	allow	Read-only repository validation.
6	./jeannie safety-case	allow	Read-only change safety review.
7	./jeannie incident	allow	Read-only incident triage/replay.
8	./jeannie ai-evals	allow	Read-only eval harness.
9	./jeannie prompt-injection-lab	allow	Read-only security lab harness.
10	./jeannie start-cluster	allow	Idempotent recovery path that starts saved Kubernetes services and worker VMs without destroying state.
11	./jeannie deploy-gitea	allow	Idempotent Debian-hosted Gitea Compose repair path for this homelab.
12	./jeannie rpi-services	allow	Idempotent RPi Pi-hole/Unbound/Uptime Kuma Compose repair path for this homelab.
13	./jeannie up	approval	High-blast-radius deployment.
14	./jeannie apps	approval	Application deployment can mutate cluster state.
15	./jeannie rpi-services	approval	Mutates RPi Docker services.
16	./jeannie nuke	deny	Destructive cluster state path.
17	tofu destroy	deny	Destructive infrastructure path.
18	terraform destroy	deny	Destructive infrastructure path.
19	rm -rf	deny	Destructive file deletion pattern.
20	kubectl delete	approval	Kubernetes deletion needs explicit scope and approval.
21	docker rm	approval	Docker deletion needs explicit scope and approval.