Least Privilege

What it does

• Stops any shell command matching sudo *.
• Stops any shell command matching chmod 777*.
• Stops any shell command matching chmod -R 777*.
• Stops any shell command matching terraform apply*.
• Stops any shell command matching terraform destroy*.
• Stops any shell command matching kubectl delete*.
• Stops writes to files matching infra/**.
• Stops writes to files matching terraform/**.
• Stops writes to files matching **/.env*.
• Stops writes to files matching ~/.ssh/**.
• Stops writes to files matching ~/.aws/**.
• Tells every agent, when its session starts: "Never disable, skip or weaken a security check, test, linter or scanner to get something to pass. If one fails, report it."

Peregrini chose this publisher. It has not checked each rule. A book cannot vary the Mandate, and no instruction in it permits anything the Mandate reserves to your own permission lines. Its blocks are added to yours: where two books block different things, both apply. Where its instructions conflict with your own, the agent says so and asks.

The exact lines

no-run sudo *
no-run chmod 777*
no-run chmod -R 777*
no-run terraform apply*
no-run terraform destroy*
no-run kubectl delete*
no-write infra/**
no-write terraform/**
no-write **/.env*
no-write ~/.ssh/**
no-write ~/.aws/**
instruction Never disable, skip or weaken a security check, test, linter or scanner to get something to pass. If one fails, report it.

Versions

1. Version 1 · 28 September 2026

   A starter book by Peregrini.

   Added: no-run sudo * · no-run chmod 777* · no-run chmod -R 777* · no-run terraform apply* · no-run terraform destroy* · no-run kubectl delete* · no-write infra/** · no-write terraform/** · no-write **/.env* · no-write ~/.ssh/** · no-write ~/.aws/** · instruction Never disable, skip or weaken a security check, test, linter or scanner to get something to pass. If one fails, report it.