[[rules]]
id = "rule-name"
priority = 100          # Lower = higher priority
effect = "allow"        # allow, deny, or audit_only
identities = "*"        # "*" for all, or { labels = ["role:dev"] }
tools = ["read_file"]   # Tool names to match

[[rules]]
id = "dev-write-safe"
priority = 110
effect = "allow"
identities = { labels = ["role:developer"] }
tools = ["write_file"]
arguments = [
    { param = "path", allow_glob = ["/tmp/**"], deny_regex = [".*\\.env$"] },
]

[[rules]]
id = "block-secrets"
priority = 1
effect = "deny"
identities = "*"
tools = "*"
arguments = [
    { param = "*", deny_regex = [
        "AKIA[A-Z0-9]{16}",
        "ghp_[a-zA-Z0-9]{36}",
        "sk-[a-zA-Z0-9]{48}",
    ]},
]