agent/destructive-commands-gated
Committed agent settings require approval for destructive commands.
Install
firedrill hub add agent/destructive-commands-gated
Reads
repos, files.agent_configs
Fix when it fails
Remove destructive commands from the allow list, or move them to the deny list.
Maps to
SOC2:CC8.1
Test cases
| Case | Expected |
|---|---|
| guarded | PASS |
| allowed | FAIL |
| no configs | N/A |
Drill file
firedrill: v0
id: agent/destructive-commands-gated
safeguard: "Committed agent settings require approval for destructive commands."
severity: high
for_each: repos
fetch:
agents: { fact: files.agent_configs }
na_reason: "agents run with their defaults; check laptops with --include-home"
pass_when:
- agents.found.all(a, a.unguarded_destructive.size() == 0)
fix: "Remove destructive commands from the allow list, or move them to the deny list."
maps_to: [SOC2:CC8.1]