block-unbounded-storage-retention

━━ when it runs

• PreToolUsebefore the tool call runs. a denial here means the command never executes at all.

watchesevery tool the event fires for — not narrowed to particular tools

this pack enforces: a match returns a real denial rather than being recorded and discarded. what the denial then does depends on the event above.

━━ install

this one is opt-in. taking the pack without flags leaves it off until you tick it, so install it by name if you want only this.

• just this policy$failproofai policies add chhhee10/cost-guard --policy block-unbounded-storage-retention⧉ copy
• the whole pack$failproofai policies add chhhee10/cost-guard⧉ copy
• turn just this off$failproofai policies remove block-unbounded-storage-retention⧉ copy
• pick from a list$failproofai policies add⧉ copy
• uninstall the pack$failproofai policies remove chhhee10/cost-guard⧉ copy

ships in chhhee10/cost-guard · v4e133099d12a · source ↗

━━ also in data

• block-whole-bucket-recursive-copyRefuse a recursive copy or sync whose source is a whole bucket
• block-cross-region-bucket-transferRefuse a bucket-to-bucket copy whose two ends are in different regions
• block-whole-database-export-or-restoreRefuse a full dump of a managed database, or a snapshot restore into a new instance