---
title: Destructive actions require explicit go
slug: destructive-actions-require-explicit-go
pageKind: principle
status: published
abstract: Before any destructive infrastructure action — volume wipes, force-pushes, secret rotation, recreates that lose state — list the steps and wait for an explicit go.
principleTier: commandment
principleDirection: List the steps and wait for an affirmative go before any destructive infrastructure action; this overrides autonomous-directive blanket approval.
principleDimensionVector: {"blast_radius": 1.0, "governance_compliance": 0.9, "evidence_density": 0.7, "speed_to_value": -0.4}
principleAppliesTo:
  - in_platform_coworker
  - external_coding_agent
principleRingScope:
  - universal-ring
principleConsumerArchetype: ai-coworker-universal
principlePublic: false
authoredAt: 2026-05-18
authoredBy: mark-bodman
principleRuntimeEnforcement: {"interactiveMode":"confirm","autonomousMode":"refuse","patterns":[{"kind":"git","regex":"^push\\s+.*--force(-with-lease)?\\b.*\\bmain\\b","rationale":"force-push to main is on the destructive list"},{"kind":"shell","regex":"^git\\s+reset\\s+--hard\\b","rationale":"git reset --hard past committed work is destructive"},{"kind":"shell","regex":"^rm\\s+(-rf|-r\\s+-f|-fr|-rfv|-vrf)\\s+/","rationale":"rm -rf on a rooted absolute path is irreversible"}]}
---

# Destructive actions require explicit go

**Before executing any action that destroys, recreates, or significantly
mutates infrastructure, list the steps and wait for an affirmative
"go".** This holds even under an
[autonomous-directives-are-blanket-approval](autonomous-directives-are-blanket-approval.md)
grant — destructive operations are out-of-scope for blanket approval by
default.

## What counts as destructive

- Anything that wipes data: `docker compose down -v`, `docker volume rm`,
  `prisma migrate reset`, `DROP TABLE`, `DELETE FROM` on non-test data
- Anything that recreates infrastructure: `docker compose build` of
  production-tier images (which can invalidate cached state),
  recreating containers that hold uncommitted state
- Anything that touches secrets / credentials: rotating an OAuth client
  secret, regenerating an API key, replacing the credential-encryption key
- Mass bash on startup or session resume — the agent has been locked
  out of a machine before by an over-eager `npm install` + `docker compose
  build` chain
- Force-push to a protected branch, branch deletion of unmerged work,
  `git reset --hard` past committed work
- Modifying compose volumes / networks / project labels in ways that
  trigger Docker to recreate named volumes

## What's NOT destructive (and so does not need a fresh OK)

- Read-only inspection: `psql ... -c "SELECT ..."`, `docker logs`, `git
  status`, `ls`
- Idempotent re-application: re-running `pnpm install`, re-running a
  successful seed, re-running a healthy migration
- File-system changes within the agent's worktree that are tracked in
  git (the worktree itself is the audit trail)
- Restarting healthy containers without rebuilding (`docker compose up
  -d portal`)

## The contract

When a destructive action is needed:

1. **List the steps in plain language.** "I'll rebuild the portal
   image, recreate the portal container, and reseed the DB to pick up
   the new model." Not shell — operator-readable steps.
2. **Wait for the operator's explicit go.** "Yes", "do it", "go ahead",
   "proceed" — not silence, not "you decided already."
3. **Execute only the listed steps.** If the work mid-execution
   surfaces an additional destructive action, stop and ask again.
4. **Report the outcome of each step**, not just the final state.

## Anti-pattern

- Running `docker compose down -v` to fix a port conflict ("just gonna
  recreate the volumes")
- Running `npm install` + `docker compose build` on session start "to
  make sure everything is fresh"
- Adding a `prisma migrate reset` to a recovery script "since we're
  already wiping things"

Every one of these has, at some point, cost the operator hours.

## Penalty

This is a **commandment-tier** principle. The first violation that
named it locked the operator out of their machine for a day. The
ongoing cost of asking "want me to rebuild the portal image?" is
zero. The cost of an unsolicited destructive action is unbounded.

## Related principles

- [`autonomous-directives-are-blanket-approval`](autonomous-directives-are-blanket-approval.md) —
  blanket approval covers the announced plan, not destructive surprises
- [`never-wipe-db-for-code-fixes`](never-wipe-db-for-code-fixes.md) —
  data-loss-tier specific case
- [`evidence-before-diagnosis`](evidence-before-diagnosis.md) — confirm
  the cause before reaching for a destructive fix
