shieldset:
  policy:
    composite_scoring:
      enabled: false
    workspace_probe:
      enabled: false
    decision_memory:
      enabled: false
    burst_detector:
      enabled: false

  rules:
    # Only the universal SQL guard exists. Writes to prod are still
    # allowed; the new "added" rule will catch them in the after-state.
    - id: sql.drop_database
      severity: Critical
      points: 6
      where: tool_call
      match:
        tool: [execute_sql]
        sql_matches: ['(?i)\bDROP\s+DATABASE\b']
      reason: "DROP DATABASE is never auto-allowed."
