CC Safety Net official rulebooks

Opt-in CC Safety Net rulebooks that block recognizable destructive infrastructure CLI operations before a coding agent runs them. One rulebook per CLI:

Rulebook	CLI	Rules
terraform	terraform	destroy, apply -destroy, state rm/push, workspace delete
aws	aws	S3 and S3 API deletion, EC2, CloudFormation, RDS, DynamoDB, EKS, KMS
gcloud	gcloud	projects, compute, storage, SQL, GKE, KMS, Secret Manager, release channels
azure	az	resource, VM, AKS, storage, SQL, Cosmos DB, Key Vault

Each rulebook is curated coverage of recognizable accidental operations, not a complete model of the provider API. The linked evidence page for each rulebook records why every rule exists, its safe previews, deliberate exclusions, and known gaps.

Rulebooks are JSON data. They are never executed, they only add denials, and they cannot weaken CC Safety Net's built-in protections.

Requirements

Requires CC Safety Net 2.3.0 or later (the first release with rulebook_version: 2 support).

Install

User scope (recommended — these CLIs are used across projects):

# Follow the latest reviewed rulebook; content changes only when you run 'rule update'.
ccsn rule add cc-safety-net/rulebooks#main/terraform --global

# Or install from an immutable release tag.
ccsn rule add cc-safety-net/rulebooks#v1.0.0/terraform --global

Installing copies the rulebook into your own configuration (vendoring). Replace terraform with aws, gcloud, or azure. Team repositories can omit --global to commit project-scoped configuration; the vendored rulebook files travel with the repository, so teammates need no extra step.

Installing every rulebook at once (ccsn rule add cc-safety-net/rulebooks --global) vendors each rulebook as an individual source.

Update and remove

ccsn rule update                                            # re-resolve all followed branch/tag refs
ccsn rule update cc-safety-net/rulebooks#main/terraform     # refresh one source
ccsn rule remove cc-safety-net/rulebooks#main/terraform --global
ccsn rule list                                              # inspect active rulebooks

Updates are always explicit. Installing a rulebook never creates automatic background updates; your copy changes only when you run rule update, which shows the diff before overwriting. Release tags are immutable, so a tag install always vendors the same content.

Overriding individual rules

Disable a rule or replace its reason with CC Safety Net's per-rule overrides — see ccsn rule doc and the custom rules documentation.

What this is not

Not a replacement for IAM, deletion protection, Terraform policy controls, backups, a sandbox, or plan review. It guards against recognizable mistakes at the moment an agent proposes a shell command.

Contributing

See CONTRIBUTING.md for the rule inclusion policy, fixture requirements, and the release checklist. Rule changes are treated as security-policy changes.