diff --git a/agent/extensions/guardrails.json b/agent/extensions/guardrails.json
index a4c013e..916aa8d 100644
--- a/agent/extensions/guardrails.json
+++ b/agent/extensions/guardrails.json
@@ -64,6 +64,11 @@
         "pattern": "kubectl delete",
         "description": "Kubernetes resource deletion"
       },
+      {
+        "pattern": "(?:^|[|&;\\n]\\s*)kubectl\\b(?=[^|&;\\n]*\\b(?:apply|create|delete|patch|replace|edit|scale|rollout\\s+(?:restart|undo)|drain|cordon|uncordon|taint|label|annotate|set|exec|cp|debug|run|attach|port-forward|proxy)\\b)",
+        "regex": true,
+        "description": "Kubernetes cluster action (including remote command execution); require explicit approval before changing or executing in a cluster."
+      },
       {
         "pattern": "docker system prune",
         "description": "Docker system cleanup (removes images/containers/volumes)"