destructive-action-policy-matrix

name	destructive-action-policy-matrix
description	Classify every destructive/gated action an agent body can attempt (git, filesystem, network, shell, github) into block/approve/allow tiers, and audit whether the pre-tool and post-tool governance backing that classification is real: blocked actions proven zero-side-effect by a negative fixture, every denial backed by a receipt and a transcript event, every block-tier denial paired with a safe alternative, and no unmanaged or same-UID body ever marked "contained." Use when building or reviewing Agent Harbor's C5 governance gate (destructive git blocker, approval request/result, denial receipts), gating a new tool surface before it can run destructive commands, or auditing whether an existing "destructive-action blocked" claim actually has evidence behind it. NOT for proving an existing sandbox boundary actually contains an adversary once an action is isolated (use sandboxed-adversarial-test-harness), deciding where in a DAG to place a human review node or designing the approval UX itself (use human-gate-designer), or designing the general work-receipt schema across an entire agent task (use agent-work-receipt-designer).
license	Apache-2.0
allowed-tools	Read,Write,Edit,Bash,Grep,Glob
metadata	{"category":"Agent & Orchestration","tags":["destructive-action","policy-matrix","pre-tool-gate","denial-receipt","governance"],"provenance":{"kind":"first-party","owners":["port-daddy"]},"pairs-with":[{"skill":"sandboxed-adversarial-test-harness","reason":"This skill classifies and audits policy/evidence; that skill proves the isolation boundary a containment claim depends on actually holds."},{"skill":"human-gate-designer","reason":"Approve-tier rows in this matrix are exactly the DAG nodes that skill designs the human review UX and routing for."},{"skill":"agent-work-receipt-designer","reason":"A denial receipt is a specialized, single-decision instance of the broader work receipt that skill's schema covers."},{"skill":"articles-of-agreement-auditor","reason":"This policy matrix is the tool-use half of the Articles contract that skill audits; a gated action is one clause whose enforcement mechanism must be real."}],"io-contract":{"kind":"deliverable","consumes":["[Truncated]","[Truncated]"],"produces":["[Truncated]","[Truncated]"]}}

Destructive Action Policy Matrix

Classify every destructive/gated action into block/approve/allow, then prove the governance behind that classification is real, not asserted.

Use This For

• Building Agent Harbor's C5 governance gate: destructive git blocker, approval request/result, denial receipts, tool-result persistence, safe alternatives.
• Gating a new tool or MCP surface before it can run destructive commands (rm -rf, git reset --hard, gh repo delete, arbitrary shell exec, egress to a new host).
• Auditing an existing "we block destructive git" claim to check whether a negative fixture actually proved zero side effects, or whether it's just documentation.
• Deciding whether a denial is real (receipt + transcript event + safe alternative) or just a log line nobody reads.
• Catching a report that overclaims containment for a same-UID or unmanaged agent body.

Do Not Use This For

• Proving an already-classified, already-isolated action's sandbox actually holds against an active adversary (sandboxed-adversarial-test-harness) — this skill audits the policy and evidence, not the isolation mechanism itself.
• Designing where in a DAG a human review node belongs or how the approval UX looks (human-gate-designer) — this skill only asks whether an approve-tier action has the pre-tool gate, receipt, and transcript coverage a human gate depends on.
• Designing the general work-receipt schema for an entire agent task's evidence (agent-work-receipt-designer) — a denial receipt here is one specialized row of that broader shape, not the schema itself.

Classification And Audit Process

flowchart TD
  A[Inventory every tool surface's destructive/gated actions] --> B[Classify each into git/filesystem/network/shell/github]
  B --> C[Assign tier: block, approve, or allow]
  C --> D{Tier is block or approve?}
  D -->|Yes| E[Wire pre-tool gate, denial receipt, transcript event]
  D -->|No allow| F[No gate required]
  E --> G{Tier is block?}
  G -->|Yes| H[Run negative fixture; prove zero side effects; document safe alternative]
  G -->|No approve| I[Human gate decides; receipt+transcript still required]
  H --> J[Run scripts/policy_matrix_audit.mjs]
  I --> J
  F --> J
  J --> K{pass and zero critical findings?}
  K -->|No| C
  K -->|Yes| L[Gate deploy on green matrix]

1. Inventory every destructive/gated action the tool surface exposes. A new MCP tool or CLI is unclassified by default — never implicitly allow.
2. Classify each action's category (, , , , ) using . Category creep or "it's usually fine" reasoning is a finding waiting to happen.