The agent ran terraform destroy on production. Then it lied about it.

policies:
  # Block destructive commands entirely
  - name: "Block destructive shell commands"
    match:
      tool: "shell_exec"
      arguments:
        command: "(rm -rf|dd if=|mkfs|> /dev/sd).*"
    action: deny
    response:
      error: "Destructive commands are not permitted"

  # Block remote script execution
  - name: "Block curl pipe to bash"
    match:
      tool: "shell_exec"
      arguments:
        command: "(curl|wget).*\|.*(bash|sh)"
    action: deny
    response:
      error: "Remote script execution is blocked"

  # Block infrastructure destruction
  - name: "Block terraform destroy"
    match:
      tool: "shell_exec"
      arguments:
        command: "terraform destroy.*"
    action: deny
    response:
      error: "terraform destroy requires manual execution"

  # Require approval for production deployments
  - name: "Approve production deployments"
    match:
      tool: "shell_exec"
      arguments:
        command: "(kubectl apply|terraform apply|helm upgrade|sam deploy).*"
    action: require_approval
    approval:
      timeout_minutes: 30
      channels: [approval_channel]
      reason: "Production deployment requires human approval"

  # Require approval for sudo commands
  - name: "Approve sudo commands"
    match:
      tool: "shell_exec"
      arguments:
        command: "^sudo .*"
    action: require_approval
    approval:
      timeout_minutes: 15
      channels: [approval_channel]

  # Allow read-only operations
  - name: "Allow read operations"
    match:
      tool: "shell_exec"
      arguments:
        command: "^(ls|cat|grep|find|head|tail|echo|pwd|which|env) .*"
    action: allow

policies:
  # Block access to system and credential directories
  - name: "Protect system paths"
    match:
      tool: ["read_file", "write_file", "delete_file"]
      arguments:
        path: "^(/etc/|/root/|.*\.ssh/|.*\.aws/).*"
    action: deny
    response:
      error: "Access to system paths is not permitted"

  # Block environment file modifications
  - name: "Protect environment files"
    match:
      tool: ["write_file", "delete_file"]
      arguments:
        path: ".*\.env(\..*)?$"
    action: deny
    response:
      error: "Environment file modifications require manual review"

  # Require approval for production configs
  - name: "Approve production config changes"
    match:
      tool: "write_file"
      arguments:
        path: ".*(prod|production).*\.(yaml|yml|json|toml)$"
    action: require_approval
    approval:
      timeout_minutes: 30
      channels: [approval_channel]

  # Allow project directory operations
  - name: "Allow workspace access"
    match:
      tool: ["read_file", "write_file"]
      arguments:
        path: "^/workspace/.*"
    action: allow