apiVersion: atmos/v1
kind: Policy
metadata:
  name: local-safety
  description: Reject destructive Terraform commands before configuration or tools run.
spec:
  policies:
    deny-destroy:
      on: command
      action: deny
      reason: Destructive Terraform operations are disabled in this example. Use a reviewed teardown process instead.
      rule: input.command == 'terraform destroy' || (input.command.startsWith('terraform ') && input.destroy)