{
  "version": "fak-policy/v1",

  "allow": [
    "Read",
    "Edit",
    "Write",
    "Glob",
    "Grep",
    "LS",
    "TodoWrite",
    "Bash",
    "BashOutput",
    "KillShell",
    "git_status",
    "git_diff",
    "git_log",
    "git_add",
    "git_commit",
    "git_push"
  ],

  "allow_prefix": [
    "read_",
    "get_",
    "search_",
    "list_",
    "lookup_",
    "find_"
  ],

  "arg_rules": [
    { "tool": "git_push", "arg": "ref",             "deny_regex": "(?i)^(refs/heads/)?(main|master|trunk|develop|release(/.+)?|prod(uction)?)$", "reason": "POLICY_BLOCK" },
    { "tool": "git_push", "arg": "branch",          "deny_regex": "(?i)^(refs/heads/)?(main|master|trunk|develop|release(/.+)?|prod(uction)?)$", "reason": "POLICY_BLOCK" },
    { "tool": "git_push", "arg": "force",           "deny_regex": "(?i)^(true|1|yes|on)$", "reason": "POLICY_BLOCK" },
    { "tool": "git_push", "arg": "force_with_lease","deny_regex": "(?i)^(true|1|yes|on)$", "reason": "POLICY_BLOCK" },

    { "tool": "Bash", "arg": "command", "deny_regex": "\\bgit\\s+push\\b", "reason": "POLICY_BLOCK" },
    { "tool": "Bash", "arg": "command", "deny_regex": "\\brm\\s+-[A-Za-z]*[rRfF]", "reason": "POLICY_BLOCK" },
    { "tool": "Bash", "arg": "command", "deny_regex": "\\bsudo\\b", "reason": "POLICY_BLOCK" }
  ],

  "self_modify_globs": [
    "internal/abi/",
    "internal/kernel/",
    "internal/adjudicator/",
    "internal/policy/",
    ".git/",
    ".ssh/",
    "VERSION"
  ]
}
