{
  "apiVersion": "hub.example.com/v1alpha1",
  "kind": "Policy",
  "metadata": {
    "name": "010 Deny Generic Privileged Tools",
    "slug": "010-deny-generic-privileged-tools"
  },
  "spec": {
    "priority": 10,
    "description": "Irrevocably block generic shell, filesystem, Docker, SQL, secret and arbitrary HTTP capabilities.",
    "match": {
      "toolPatterns": [
        "shell.*",
        "filesystem.*",
        "docker.raw_*",
        "database.execute_*",
        "secrets.*",
        "http.request_*"
      ]
    },
    "conditions": {},
    "decision": "deny_and_alert",
    "terminal": true
  }
}