diff --git a/.claude/settings.json b/.claude/settings.json
index c8b3df6..0587964 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -7,13 +7,26 @@
   },
   "permissions": {
     "allow": [
-      "Bash(git status*)", "Bash(git diff*)", "Bash(git log*)", "Bash(git pull*)",
-      "Bash(git grep*)", "Bash(grep *)", "Bash(ls *)", "Bash(cat scripts/*)",
-      "Bash(cat runbooks/*)", "Bash(cat docs/*)", "Bash(jq *)",
-      "Bash(juju status*)", "Bash(juju models*)", "Bash(juju machines*)",
-      "Bash(juju spaces*)", "Bash(juju show-*)", "Bash(juju info *)",
+      "Bash(git status*)",
+      "Bash(git diff*)",
+      "Bash(git log*)",
+      "Bash(git pull*)",
+      "Bash(git grep*)",
+      "Bash(grep *)",
+      "Bash(ls *)",
+      "Bash(cat scripts/*)",
+      "Bash(cat runbooks/*)",
+      "Bash(cat docs/*)",
+      "Bash(jq *)",
+      "Bash(juju status*)",
+      "Bash(juju models*)",
+      "Bash(juju machines*)",
+      "Bash(juju spaces*)",
+      "Bash(juju show-*)",
+      "Bash(juju info *)",
       "Bash(maas admin * read*)",
-      "Bash(openstack * list*)", "Bash(openstack * show*)",
+      "Bash(openstack * list*)",
+      "Bash(openstack * show*)",
       "Bash(bash scripts/repo-lint.sh*)",
       "Bash(bash scripts/ledger-scan.sh*)",
       "Bash(bash scripts/opentofu-validate.sh*)",
@@ -37,47 +50,89 @@
       "Bash(tofu providers schema*)",
       "Bash(tofu version*)",
       "Bash(ip route*)",
-      "Bash(systemctl is-active *)"
+      "Bash(systemctl is-active *)",
+      "Bash(tofu plan*)",
+      "Bash(tofu -chdir=* plan*)",
+      "Bash(bash scripts/dc-plane-ipam.sh check*)",
+      "Bash(bash scripts/octavia-pki.sh verify*)",
+      "Bash(bash scripts/dc-node-carve.sh check*)",
+      "Bash(python3 scripts/creds-matrix.py*)",
+      "Bash(bash scripts/maas-role-tags.sh check*)",
+      "Bash(bash scripts/pre-flight-checks.sh*)",
+      "Bash(bash scripts/dc-region-topology.sh check*)",
+      "Bash(bash scripts/maas-profile-assert.sh *)",
+      "Bash(bash scripts/creds-probe.sh --list*)",
+      "Bash(bash scripts/dc-cache-proxy.sh check*)"
     ],
     "ask": [
-      "Bash(juju destroy-model *)", "Bash(juju remove-machine *)",
-      "Bash(juju remove-application *)", "Bash(juju remove-unit *)",
-      "Bash(juju run *)", "Bash(juju ssh *)", "Bash(juju exec *)",
-      "Bash(juju config * *=*)", "Bash(juju attach-resource *)",
-      "Bash(juju deploy *)", "Bash(juju add-model *)",
-      "Bash(maas admin machine delete *)", "Bash(maas admin * update*)",
-      "Bash(maas admin * create*)", "Bash(maas admin * release*)",
-      "Bash(openstack * create*)", "Bash(openstack * delete*)",
-      "Bash(openstack * set*)", "Bash(openstack * unset*)",
+      "Bash(juju destroy-model *)",
+      "Bash(juju remove-machine *)",
+      "Bash(juju remove-application *)",
+      "Bash(juju remove-unit *)",
+      "Bash(juju run *)",
+      "Bash(juju ssh *)",
+      "Bash(juju exec *)",
+      "Bash(juju config * *=*)",
+      "Bash(juju attach-resource *)",
+      "Bash(juju deploy *)",
+      "Bash(juju add-model *)",
+      "Bash(maas admin machine delete *)",
+      "Bash(maas admin * update*)",
+      "Bash(maas admin * create*)",
+      "Bash(maas admin * release*)",
+      "Bash(openstack * create*)",
+      "Bash(openstack * delete*)",
+      "Bash(openstack * set*)",
+      "Bash(openstack * unset*)",
       "Bash(* --apply*)",
-      "Bash(git commit*)", "Bash(git push*)",
-      "Bash(sudo *)", "Bash(virsh *)", "Bash(rm *)",
+      "Bash(git commit*)",
+      "Bash(git push*)",
+      "Bash(sudo *)",
+      "Bash(virsh *)",
+      "Bash(rm *)",
       "Bash(*opnsense-api.sh POST *)",
       "Bash(*opnsense-plugins.sh apply*)",
-      "Bash(*tofu apply*)", "Bash(*tofu destroy*)",
-      "Bash(*tofu import*)", "Bash(*tofu state rm*)",
+      "Bash(*tofu apply*)",
+      "Bash(*tofu destroy*)",
+      "Bash(*tofu import*)",
+      "Bash(*tofu state rm*)",
       "Bash(*--commit*)",
-      "Bash(git merge*)", "Bash(git revert*)", "Bash(git reset*)",
-      "Bash(git rebase*)", "Bash(git branch -D *)",
-      "Bash(bash scripts/* apply*)", "Bash(bash scripts/* install*)",
+      "Bash(git merge*)",
+      "Bash(git revert*)",
+      "Bash(git reset*)",
+      "Bash(git rebase*)",
+      "Bash(git branch -D *)",
+      "Bash(bash scripts/* apply*)",
+      "Bash(bash scripts/* install*)",
       "Bash(ssh * sudo *)",
-      "Bash(ssh *'sudo *)", "Bash(ssh *\"sudo *)", "Bash(ssh *sudo -n *)",
+      "Bash(ssh *'sudo *)",
+      "Bash(ssh *\"sudo *)",
+      "Bash(ssh *sudo -n *)",
       "Bash(*creds-matrix.py *--privileged*)",
       "Bash(scp *)",
       "Bash(* | ssh *)",
-      "Bash(ssh * virsh *)", "Bash(ssh *'virsh *)", "Bash(ssh *\"virsh *)",
+      "Bash(ssh * virsh *)",
+      "Bash(ssh *'virsh *)",
+      "Bash(ssh *\"virsh *)",
       "Skill(*)",
-      "Edit(.claude/settings.json)", "Edit(.claude/settings.local.json)"
+      "Edit(.claude/settings.json)",
+      "Edit(.claude/settings.local.json)"
     ],
     "deny": [
-      "Bash(vault operator init*)", "Bash(vault operator rekey*)",
+      "Bash(vault operator init*)",
+      "Bash(vault operator rekey*)",
       "Bash(vault operator generate-root*)",
       "Bash(juju destroy-controller *)",
       "Bash(maas list*)",
-      "Bash(git push --force*)", "Bash(git push -f*)",
-      "Bash(*python3 -m scripts*)", "Bash(*caveman-compress*)",
-      "Read(~/vault-init/**)", "Read(~/as-executed/**)",
-      "Read(~/tenant-*/**)", "Read(**/*-cred.txt)", "Read(**/*appcred*)",
+      "Bash(git push --force*)",
+      "Bash(git push -f*)",
+      "Bash(*python3 -m scripts*)",
+      "Bash(*caveman-compress*)",
+      "Read(~/vault-init/**)",
+      "Read(~/as-executed/**)",
+      "Read(~/tenant-*/**)",
+      "Read(**/*-cred.txt)",
+      "Read(**/*appcred*)",
       "Edit(~/vault-init/**)"
     ]
   },
@@ -86,7 +141,10 @@
       {
         "matcher": "Bash",
         "hooks": [
-          { "type": "command", "command": "python3 \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/guard-destructive.py" }
+          {
+            "type": "command",
+            "command": "python3 \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/guard-destructive.py"
+          }
         ]
       }
     ]