{
  // User-configurable, global-only hard boundary. Project policy, session
  // grants and AutoReview cannot override a matching deny.
  "version": 1,
  "permission": {
    "bash": {
      "rm -rf /": "deny",
      "rm -rf /*": "deny",
      "rm -rf ~": "deny",
      "rm -rf ~/*": "deny",
      "sudo rm -rf /": "deny",
      "sudo rm -rf /*": "deny",
      "mkfs*": "deny",
      "dd * of=/dev/*": "deny"
    }
  }
}