From 4a391c2508d585beaee6f5fe370fe70c1a01c3a0 Mon Sep 17 00:00:00 2001
From: Seth Etter <mail@sethetter.com>
Date: Mon, 13 Jul 2026 08:35:01 -0500
Subject: [PATCH] pi: guardrails: add kubectl

---
 agent/extensions/guardrails.json | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/agent/extensions/guardrails.json b/agent/extensions/guardrails.json
index a4c013e..916aa8d 100644
--- a/agent/extensions/guardrails.json
+++ b/agent/extensions/guardrails.json
@@ -64,6 +64,11 @@
         "pattern": "kubectl delete",
         "description": "Kubernetes resource deletion"
       },
+      {
+        "pattern": "(?:^|[|&;\\n]\\s*)kubectl\\b(?=[^|&;\\n]*\\b(?:apply|create|delete|patch|replace|edit|scale|rollout\\s+(?:restart|undo)|drain|cordon|uncordon|taint|label|annotate|set|exec|cp|debug|run|attach|port-forward|proxy)\\b)",
+        "regex": true,
+        "description": "Kubernetes cluster action (including remote command execution); require explicit approval before changing or executing in a cluster."
+      },
       {
         "pattern": "docker system prune",
         "description": "Docker system cleanup (removes images/containers/volumes)"
-- 
2.51.2