---
description: Safety floor — never run destructive operations (rm -rf, force-push, DROP TABLE, --no-verify) without explicit confirmation. Universal across all phases.
---

# Guardrails

Safety rules that apply to every action. When in doubt, ask.

## Blocked Operations

Never execute without explicit user confirmation:

- `rm -rf` — Use targeted deletes instead
- `DROP TABLE`, `DROP DATABASE`, `TRUNCATE`
- `git push --force` — Suggest `--force-with-lease` and confirm
- `git reset --hard` — Warn about data loss
- `--no-verify` on any git command — Hooks exist for a reason

## Require Confirmation Before

- Deleting git branches (local or remote)
- Modifying CI/CD configuration files
- Running destructive database migrations
- Overwriting files outside the current project
- Any operation described as "irreversible"

## Never Commit Secrets

See [rules/common/security.md](security.md) for canonical secrets handling.

## Deployment

The `deliver-deploy` skill and `/hotfix` command respect all guardrails. Speed does not override the confirmation requirement for irreversible actions.

## When Uncertain

Stop and ask the user. A 30-second question is better than a 30-minute rollback.