rules:
    # =============================================================================
    # TOP PRIORITY SECURITY RULES
    # =============================================================================

    - name: "Check mass deletion operations"
      description: "Prevent deletion of multiple files or use of dangerous deletion flags"
      prompt: |-
        ANALYZE: Does this operation delete multiple files or use dangerous deletion patterns?

        Look for: delete_file, rm, remove_file with wildcards (*), recursive flags (-r, --recursive), force flags (-f, --force), or >5 files

        EXAMPLES:
        - kubectl get po → NOT deletion → { "allowed": true, "message": "Not a deletion operation" }
        - kubectl delete po --all → IS dangerous deletion → { "allowed": false, "message": "Wildcard deletion blocked" }
        - kubectl delete po app-1234 → NOT dangerous deletion → { "allowed": true, "message": "Single pod deletion allowed" }
        - delete_file path="*" → IS dangerous deletion → { "allowed": false, "message": "Wildcard deletion blocked" }
        - delete_file path="./file.txt" → IS safe deletion → { "allowed": true, "message": "Single file deletion allowed" }

        Tool call: %s

        Return ONLY JSON in this exact format: { "allowed": true/false, "message": "your message" }

    - name: "Check system directory access"
      description: "Prevent access to critical system directories"
      prompt: |-
        ANALYZE: Does this operation access dangerous system directories?

        Look for: file paths starting with /etc/, /sys/, /proc/, /boot/, /root/, /usr/bin/, /usr/sbin/, /bin/, /sbin/, C:\Windows\, C:\System32\, C:\Program Files\

        EXAMPLES:
        - kubectl get po → NO file path → { "allowed": true, "message": "No file path involved" }
        - read_file path="/etc/passwd" → DANGEROUS path → { "allowed": false, "message": "System directory access blocked" }
        - read_file path="./config.txt" → SAFE path → { "allowed": true, "message": "Safe file path" }

        Tool call: %s

        Return ONLY JSON in this exact format: { "allowed": true/false, "message": "your message" }

    - name: "Check command execution tools"
      description: "Prevent execution of system commands and shell access"
      prompt: |-
        ANALYZE: Is this tool name on the dangerous command execution list?

        DANGEROUS TOOLS: execute_command, exec, system, shell, bash, cmd, powershell, sh, run_command, subprocess

        EXAMPLES:
        - kubectl get po → kubectl NOT on list → { "allowed": true, "message": "Safe tool" }
        - bash command="ls" → bash IS on list → { "allowed": false, "message": "Dangerous command tool blocked" }
        - git status → git NOT on list → { "allowed": true, "message": "Safe tool" }

        Tool call: %s

        Return ONLY JSON in this exact format: { "allowed": true/false, "message": "your message" }

    - name: "Check credential file access"
      description: "Prevent access to files that typically contain credentials"
      prompt: |-
        ANALYZE: Does this operation access credential files?

        Look for: files ending with .env, .key, .pem, .p12, .pfx, .crt, .cer OR paths containing /.ssh/, /.aws/, /.gcp/, /credentials, /secrets, id_rsa, private_key OR files named passwd, shadow, htpasswd

        EXAMPLES:
        - kubectl get po → NO file access → { "allowed": true, "message": "No file access" }
        - read_file path=".env" → CREDENTIAL file → { "allowed": false, "message": "Credential file blocked" }
        - read_file path="config.txt" → NORMAL file → { "allowed": true, "message": "Normal file access" }

        Tool call: %s

        Return ONLY JSON in this exact format: { "allowed": true/false, "message": "your message" }

    - name: "Check external network access"
      description: "Prevent HTTP requests to external domains"
      prompt: |-
        ANALYZE: Does this operation make HTTP/HTTPS requests to external domains?

        Look for: http_request, fetch, download_file with URLs NOT on approved list (localhost, 127.0.0.1, ::1, *.company.com, api.openai.com)

        EXAMPLES:
        - kubectl get po → NO network request → { "allowed": true, "message": "No network request" }
        - http_request url="https://malicious.com" → EXTERNAL domain → { "allowed": false, "message": "External domain blocked" }
        - fetch url="http://localhost:3000" → APPROVED domain → { "allowed": true, "message": "Approved domain" }

        Tool call: %s

        Return ONLY JSON in this exact format: { "allowed": true/false, "message": "your message" }

    - name: "Check executable file creation"
      description: "Prevent creation of executable files"
      prompt: |-
        ANALYZE: Does this operation create executable files?

        Look for: write_file, create_file with extensions .exe, .bat, .cmd, .scr, .com, .pif, .sh, .bash, .zsh, .fish, .ps1, .psm1, .psd1 OR .py, .rb, .pl, .js outside ./scripts/ or ./dev/ directories

        EXAMPLES:
        - kubectl get po → NO file creation → { "allowed": true, "message": "No file creation" }
        - write_file path="malware.exe" → EXECUTABLE file → { "allowed": false, "message": "Executable file blocked" }
        - write_file path="./scripts/build.py" → APPROVED directory → { "allowed": true, "message": "Script in approved directory" }
        - write_file path="report.txt" → NON-EXECUTABLE → { "allowed": true, "message": "Non-executable file" }

        Tool call: %s

        Return ONLY JSON in this exact format: { "allowed": true/false, "message": "your message" }

    - name: "Check large file operations"
      description: "Prevent operations on excessively large files"
      prompt: |-
        ANALYZE: Does this operation involve excessively large files or data?

        Look for: file sizes >100MB, content >10MB, processing >1000 files at once

        EXAMPLES:
        - kubectl get po → NO file sizes mentioned → { "allowed": true, "message": "No file size limits" }
        - read_file path="huge.csv" size=200MB → TOO LARGE → { "allowed": false, "message": "File too large" }
        - write_file content="[10MB+ data]" → TOO MUCH content → { "allowed": false, "message": "Content too large" }
        - read_file path="document.pdf" → NORMAL size → { "allowed": true, "message": "Normal file size" }

        Tool call: %s

        Return ONLY JSON in this exact format: { "allowed": true/false, "message": "your message" }