apiVersion: atmos/v1
kind: Policy
metadata:
  name: component-deny-agent-production-deploy
  description: Deny production apply and deploy commands launched by Claude Code or Codex.
spec:
  policies:
    guard:
      on: component.command
      engine: starlark
      action: deny
      reason: Production apply and deploy are blocked from coding-agent sessions. Use a reviewed deployment workflow.
      rule: |
        agent = ctx.env.get("CLAUDECODE", "") == "1" or ctx.env.get("CODEX_THREAD_ID", "") != ""
        production = any([part in ["prod", "production"] for part in ctx.input["stack"].lower().replace("_", "-").replace("/", "-").split("-")])
        return agent and ctx.input["command"] in ["apply", "deploy"] and production