Skip to main content
CC Safety Net publishes curated rulebooks for the infrastructure CLIs coding agents most often touch. Each rulebook blocks recognizable destructive operations for one CLI, and one command installs it:
Rulebooks are JSON data. They are never executed, they only add denials, and they cannot weaken CC Safety Net’s built-in protections. This page covers the official catalog. The Custom rules page owns the rulebook file format and the full rule command reference.
Official rulebooks use rulebook_version: 2 and require CC Safety Net 2.3.0 or later.

​
The catalog

The cc-safety-net/rulebooks repository ships one rulebook per CLI: Each rulebook is curated coverage of recognizable accidental operations, not a complete model of the provider API. Safe previews such as aws s3 rm --dryrun, terraform state rm -dry-run, and aws ec2 terminate-instances --dry-run stay allowed. Every rulebook has an evidence page in the repository recording why each rule exists, its safe previews, deliberate exclusions, and known gaps: terraform · aws · gcloud · azure.

​
Install

Prefer user scope. You use terraform and aws across projects, so the protection should follow you rather than one repository:
--only and --ref mean something only for a repository source, so passing either one without a source selects cc-safety-net/rulebooks. Naming the repository yourself still works, and installing everything it publishes requires naming it. Omit --global to install into the project scope instead. The vendored files land under .cc-safety-net/ in the repository, so committing them ships the rules to every teammate’s clone. See Team setup. You can also add one rulebook by its canonical source spec, which is what rule list shows and rule remove takes:

​
What installing does

rule add fetches each selected rulebook, validates its schema and runs its bundled test fixtures, and vendors the file into your own scope at rules/<name>/rulebook.json. The command reports the commit the content came from. The runtime then reads your vendored copy on every tool call. There is no background fetching and no auto-update. Your copy changes only when you run:
A release tag is immutable, so a --ref v1.0.0 install always vendors the same content and rule update is a no-op for it until you switch refs.

​
Override or remove

Disable an individual rule, or replace its block reason, with a per-rule override in rule.json. The rulebook file stays untouched, so rule update never conflicts with your override. See the rule.json schema for the syntax. To drop a rulebook entirely:

​
Install from any repository

Nothing about the official repository is special. rule add owner/repo works for any GitHub repository that publishes rulebooks under .cc-safety-net/rules/<name>/rulebook.json, so a team or vendor can publish its own catalog the same way.
A rulebook only adds denials and is never executed, but its rules become part of what your agent is told when a command is blocked. Review a third-party rulebook before adding it, and prefer --ref with a tag or commit you inspected over following a branch you do not control.

​
When a rulebook does not fire

npx -y cc-safety-net rule list shows every active rulebook with its rule count, and npx -y cc-safety-net explain "terraform destroy" traces a decision to the rule that made it. If a source shows as inactive, Rulebooks are live files covers the repair steps.
Last modified on August 31, 2026