# Security rules for Brand Monitor agents

zeroAccessPaths:
  - path: ".env"
  - path: "config/api_keys.yaml"

readOnlyPaths:
  - path: "config/"
  - path: "ARCHITECTURE.md"

noDeletePaths:
  - path: "data/"
  - path: "reports/"
  - path: "config/"

bashToolPatterns:
  - pattern: "^rm"
    block: true
  - pattern: "git reset"
    block: true
  - pattern: "> /dev/"
    block: true