apiVersion: atmos/v1
kind: Policy
metadata:
  name: lifecycle-deny-production-delete
  description: "Deny direct deletion of Helm releases in production stacks."
spec:
  policies:
    deny-production-delete:
      on: operation
      engine: starlark
      action: deny
      reason: Production Helm releases cannot be deleted directly
      rule: |
        return ctx.input["event"] == "before.helm.delete" and ctx.input["stack"].startswith("prod-")