settings deny list
cannot read .env, ~/.ssh, .npmrc
blocking hooks
cannot commit to main, edit an Accepted ADR
spawn boundary
guard-agent-spawn: only a roster seat, only at its pinned model
path-scoped rules
glob rules load only when a path matches
review gates
code + security reviewers, no Edit or Write