{
  "env": {
    "CAVEMAN_DEFAULT_MODE": "off"
  },
  "enabledPlugins": {
    "caveman@caveman": false
  },
  "permissions": {
    "allow": [
      "Bash(git status*)",
      "Bash(git diff*)",
      "Bash(git log*)",
      "Bash(git pull*)",
      "Bash(git grep*)",
      "Bash(grep *)",
      "Bash(ls *)",
      "Bash(cat scripts/*)",
      "Bash(cat runbooks/*)",
      "Bash(cat docs/*)",
      "Bash(jq *)",
      "Bash(juju status*)",
      "Bash(juju models*)",
      "Bash(juju machines*)",
      "Bash(juju spaces*)",
      "Bash(juju show-*)",
      "Bash(juju info *)",
      "Bash(maas admin * read*)",
      "Bash(openstack * list*)",
      "Bash(openstack * show*)",
      "Bash(bash scripts/repo-lint.sh*)",
      "Bash(bash scripts/ledger-scan.sh*)",
      "Bash(bash scripts/opentofu-validate.sh*)",
      "Bash(bash scripts/run-tests-all.sh*)",
      "Bash(bash scripts/cloud-assert.sh)",
      "Bash(bash scripts/preflight.sh*)",
      "Bash(python3 scripts/repo_lint.py*)",
      "Bash(python3 scripts/provider-bundle-check.py*)",
      "Bash(python3 scripts/dc-dc-whole-host-budget.py*)",
      "Bash(bash tests/*)",
      "Bash(OPNSENSE_API_HOST=* bash scripts/opnsense-api.sh GET *)",
      "Bash(bash scripts/opnsense-plugins.sh list*)",
      "Bash(bash scripts/creds-audit.sh *)",
      "Bash(bash scripts/dc-dc-ceph-disk-budget.sh *)",
      "Bash(bash scripts/site-baseleg.sh check*)",
      "Bash(tofu validate*)",
      "Bash(tofu -chdir=* validate*)",
      "Bash(tofu state list*)",
      "Bash(tofu -chdir=* state list*)",
      "Bash(tofu state show*)",
      "Bash(tofu providers schema*)",
      "Bash(tofu version*)",
      "Bash(ip route*)",
      "Bash(systemctl is-active *)",
      "Bash(tofu plan*)",
      "Bash(tofu -chdir=* plan*)",
      "Bash(bash scripts/dc-plane-ipam.sh check*)",
      "Bash(bash scripts/octavia-pki.sh verify*)",
      "Bash(bash scripts/dc-node-carve.sh check*)",
      "Bash(python3 scripts/creds-matrix.py*)",
      "Bash(bash scripts/maas-role-tags.sh check*)",
      "Bash(bash scripts/pre-flight-checks.sh*)",
      "Bash(bash scripts/dc-region-topology.sh check*)",
      "Bash(bash scripts/maas-profile-assert.sh *)",
      "Bash(bash scripts/creds-probe.sh --list*)",
      "Bash(bash scripts/dc-cache-proxy.sh check*)",
      "Bash(apt-cache policy *)",
      "Bash(qemu-img info *)",
      "Bash(snap info *)",
      "Bash(snap list *)",
      "Bash(tailscale ip *)",
      "Bash(tailscale status *)",
      "Bash(tofu show *)",
      "Bash(tofu version *)",
      "Bash(git check-ignore *)",
      "Bash(git fetch *)",
      "Bash(ip route show*)",
      "Bash(ip route get *)",
      "Bash(ip neigh show*)",
      "Bash(bridge fdb show*)",
      "Bash(tc qdisc show*)",
      "Bash(ssh *'pgrep *)",
      "Bash(ssh *\"pgrep *)",
      "Bash(ssh *'ps -ef*)",
      "Bash(ssh *\"ps -ef*)",
      "Bash(timeout * ssh *'pgrep *)",
      "Bash(timeout * ssh *\"pgrep *)",
      "Bash(timeout * ssh *'ps -ef*)",
      "Bash(timeout * ssh *\"ps -ef*)",
      "Read(//etc/apparmor.d/abstractions/**)",
      "Read(//etc/apparmor.d/local/abstractions/**)",
      "Read(//etc/libvirt/**)",
      "Read(//etc/sudoers.d/**)",
      "Read(//proc/**)",
      "Read(//snap/**)",
      "Read(//sys/module/apparmor/parameters/**)",
      "Read(//sys/module/kvm_amd/parameters/**)",
      "Read(//sys/module/kvm_intel/parameters/**)",
      "Read(//var/lib/dpkg/**)",
      "Read(//var/lib/libvirt/**)",
      "Read(//var/log/libvirt/qemu/**)",
      "Read(//tmp/**)"
    ],
    "ask": [
      "Bash(juju destroy-model *)",
      "Bash(juju remove-machine *)",
      "Bash(juju remove-application *)",
      "Bash(juju remove-unit *)",
      "Bash(juju run *)",
      "Bash(juju ssh *)",
      "Bash(juju exec *)",
      "Bash(juju config * *=*)",
      "Bash(juju attach-resource *)",
      "Bash(juju deploy *)",
      "Bash(juju add-model *)",
      "Bash(maas admin machine delete *)",
      "Bash(maas admin * update*)",
      "Bash(maas admin * create*)",
      "Bash(maas admin * release*)",
      "Bash(openstack * create*)",
      "Bash(openstack * delete*)",
      "Bash(openstack * set*)",
      "Bash(openstack * unset*)",
      "Bash(* --apply*)",
      "Bash(git commit*)",
      "Bash(git push*)",
      "Bash(sudo *)",
      "Bash(virsh *)",
      "Bash(rm *)",
      "Bash(*opnsense-api.sh POST *)",
      "Bash(*opnsense-plugins.sh apply*)",
      "Bash(*tofu apply*)",
      "Bash(*tofu destroy*)",
      "Bash(*tofu import*)",
      "Bash(*tofu state rm*)",
      "Bash(*--commit*)",
      "Bash(git merge*)",
      "Bash(git revert*)",
      "Bash(git reset*)",
      "Bash(git rebase*)",
      "Bash(git branch -D *)",
      "Bash(bash scripts/* apply*)",
      "Bash(bash scripts/* install*)",
      "Bash(ssh * sudo *)",
      "Bash(ssh *'sudo *)",
      "Bash(ssh *\"sudo *)",
      "Bash(ssh *sudo -n *)",
      "Bash(*creds-matrix.py *--privileged*)",
      "Bash(scp *)",
      "Bash(* | ssh *)",
      "Bash(ssh * virsh *)",
      "Bash(ssh *'virsh *)",
      "Bash(ssh *\"virsh *)",
      "Skill(*)",
      "Edit(.claude/settings.json)",
      "Edit(.claude/settings.local.json)"
    ],
    "deny": [
      "Bash(vault operator init*)",
      "Bash(vault operator rekey*)",
      "Bash(vault operator generate-root*)",
      "Bash(juju destroy-controller *)",
      "Bash(maas list*)",
      "Bash(git push --force*)",
      "Bash(git push -f*)",
      "Bash(*python3 -m scripts*)",
      "Bash(*caveman-compress*)",
      "Read(~/vault-init/**)",
      "Read(~/as-executed/**)",
      "Read(~/tenant-*/**)",
      "Read(**/*-cred.txt)",
      "Read(**/*appcred*)",
      "Edit(~/vault-init/**)"
    ]
  },
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "python3 \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/guard-destructive.py"
          }
        ]
      }
    ]
  }
}