Set the rules.Before AI acts.

Run SELECT, EXPLAIN and schema introspection against a permitted production database, and execute destructive DDL only in an explicitly classified ephemeral test database.

Drop a production table, truncate a protected partition, hide DROP in a multi-statement batch, or target an endpoint whose environment cannot be resolved.

Describe configuration, create a restore drill in an approved sandbox or delete an explicitly ephemeral database instance.

Delete a protected instance, disable its deletion protection, remove its lock or perform the same action through an API alias.

Update one synthetic record by immutable primary key within delegated authority.

Remove the predicate after approval, change the cutoff to include more partitions or split one mass update into repeated smaller requests.

Increase retention or create an additional protected recovery point.

Disable point-in-time recovery, reduce retention below policy or delete the only valid recovery copy.

Generate and review a migration plan or apply a reversible migration in an isolated staging copy.

Apply a changed migration, bypass the release identity or run an unplanned destructive ALTER in production.

Read inventory or delete an explicitly ephemeral sandbox container with no protected descendants.

Delete a production scope, remove its protection or move/rename it to evade classification.

Generate a plan with a read/planning identity and apply the unchanged approved plan in the configured window.

Use auto-approve, apply without a saved plan, change variables after approval or apply to another workspace.

Read workload status or restart one permitted deployment through the approved rollout path.

Delete a namespace, expand a selector to all workloads, delete persistent data or target an unresolved cluster context.

Narrow an existing ingress rule or add a time-bound internal source range to a non-critical service.

Open a database/admin port globally, remove the private endpoint or split a public path across multiple changes.

Add a new log sink or increase retention without weakening required coverage.

Stop logging, delete the central trail, add an exclusion for privileged changes or disable a required detector.

Read key metadata or perform an authorised encrypt/decrypt operation through the workload role.

Schedule deletion, purge the vault, export key material or add the agent as key administrator.

Read the actor’s effective access or request a separately approved temporary role through the authorised workflow.

Grant itself access directly or via a group, change its trust policy or disable the control that would block it.

Request a narrowly scoped, time-bound operational role through PIM/JIT.

Grant a tier-zero role directly, via a custom role or through nested protected-group membership.

Activate an approved, exact role on one resource for the approved duration.

Broaden scope, extend expiry, change role after approval or reuse the approval for another principal.

Add a stronger authentication method or narrow a temporary test exclusion in a sandbox tenant.

Disable the policy, add a broad bypass, remove device trust or extend privileged sessions beyond the baseline.

Disable one verified departed user through the normal HR-driven workflow.

Disable a broad group, include a break-glass account or split a mass deactivation into small batches.

Obtain a short-lived, audience-bound token through the approved workload identity flow.

Create a non-expiring key, write a secret into the repository or print returned secret material into agent output.

Reference a secret by identifier in deployment configuration without revealing its value.

Retrieve and print a secret, encode it to evade detection or place it in a repository, prompt, ticket or message.

Retrieve the minimum permitted fields for the customer linked to the assigned case.

Change the record ID, use global search or follow a relationship to access another tenant’s data.

Export an approved aggregate without direct identifiers to a governed analytics workspace.

Add sensitive fields after approval, switch to a personal destination or split a large export into small batches.

Share an internal-classified document with a named employee who already has approved workspace access.

Create an anonymous link, change recipient after approval or share a revised sensitive document under an old approval.

Create a synthetic or verified masked dataset in the approved test account.

Share the raw snapshot, restore it to a lower-trust account or disable masking after access is granted.

Send an approved minimal dataset to a governed in-region processor for the recorded purpose.

Change region or tenant after approval, use a personal workspace or omit destination context.

Create a feature branch and open a pull request that is subject to all required checks.

Disable the ruleset, self-add to bypass, dismiss a required review or force-push to the protected branch.

Change a test command without altering permissions, events, runner class, secrets or external code sources.

Add write permission after approval, reference a floating untrusted action or expose secrets to fork-controlled code.

Publish a signed artifact from the approved builder with matching commit and passing policy.

Publish from a laptop, reuse a tag for a different digest or omit required provenance/scan evidence.

Deploy the exact approved digest to the approved environment during the window.

Change tag/digest, add a region, alter migration inputs or reuse approval for another service.

Commit a documented placeholder or secret reference that cannot authenticate.

Encode a live key, expose it in logs or upload a dump through a build artifact or preview deployment.

Merge an agent-authored documentation or test-only change with one human approval, or a protected-path change approved by an independent CODEOWNERS reviewer.

Merge an agent-authored change to the auth module approved only by its prompter, or let the agent dismiss a review and merge its own workflow edit.

Paste the same content into the sanctioned enterprise tenant of the same provider, or use a personal account for content classified as public.

Upload a confidential file to a personal account, grant a personal AI app access to company drive, or split a protected document across several pastes.

Install an allowlisted extension whose permission set matches the approved version.

Install an unlisted AI extension with broad host access, accept a permission-expanding update, or side-load the same extension from a folder.

Install a pinned, allowlisted assistant under the enterprise tenant and use it with content exclusions in place.

Install an unlisted extension with shell access, sign in with a personal account in a company repository, or disable permission prompts through a committed settings file.

Connect to a registered server through the gateway endpoint and call a tool the caller’s role permits.

Add a direct server entry for a gateway-fronted system, launch an unregistered local server, or let the agent modify its own connector configuration.

Load a scanned, digest-pinned safetensors model from the internal proxy, or install a skill from the internal reviewed catalogue.

Load an unscanned pickle model, install an unreviewed skill from a marketplace, or pull a model by floating tag directly from the hub.

Enable a reviewed feature for the approved workspace with the recorded scopes and training opt-out in place.

Enable an unreviewed vendor AI feature tenant-wide, approve a broad-scope AI app consent at user level, or accept new training terms without review.

Use an inventoried tool through its approved route and confirm a decision record exists for the action.

Use the same tool through a personal login or a direct endpoint; the action is evaluated by SA-01 to SA-05, not allowed under this policy.

Prepare a payee-change request with redacted comparison data for human verification.

Apply the change, bypass verification or submit a payment to the newly supplied destination.

Create a draft payment within preparation permissions without releasing funds.

Release without two approvers, split around limits, change payee after approval or create a duplicate via retry.

Issue one valid refund within delegated authority to the original payment method.

Change destination, exceed cumulative limit, refund more than the remaining amount or reuse approval for another charge.

Prepare a reversing journal in an open period for authorised review.

Delete or overwrite the original, reopen the period or remove evidence of the change.

Read live configuration or change test-mode routing within delegated scope.

Change live settlement, weaken fraud controls, reveal signing material or alter approved values before execution.

Save a draft or send a test only to the approved internal test list.

Send to a real audience without approval, change the segment/content or split a large broadcast into smaller sends.

Read the minimum account fields for the customer attached to the assigned case.

Swap account ID, follow a relationship across tenants or act on an account with no assignment context.

Disable one compromised token or perform a reversible action within documented support authority.

Delete/suspend the wrong tenant, change target after approval or remove all access using a broad selector.

Prepare a standard quote within documented discount authority.

Increase discount, add non-standard terms after approval or send a binding offer under a different account.

Apply a documented, low-value support extension within delegated authority.

Grant uncontracted premium access, remove contracted features or split extensions around limits.

Summarise interview evidence or draft a notice for authorised human review.

Set the final status, bulk reject from model score or send the decision without a verified human owner.

Retrieve permitted fields for an assigned employee case or an explicitly assigned legal matter.

Use global search, guess record ID or follow links into an unassigned restricted cohort or matter.

Prepare a compensation-change file and show aggregate validation without revealing unnecessary individual data.

Release payroll without dual approval, change bank details and immediately pay, or edit values after approval.

Prepare a draft envelope with the authorised signatory for review, without sending.

Send or sign a changed document, swap counterparty/signatory or rely on a prior generic approval.

Generate a disposition review list for records whose schedule has matured and have no active hold.

Remove a hold, shorten retention or delete any held record even through a different connected system.