// =============================================================================
// Code Agent — Security
// =============================================================================
// Secrets protection for coding assistants.
// Prevents code agents from writing detected secrets to output files.
//
// Category: security
// Namespace: Guardrails
// =============================================================================

@id("code-block-write-secrets")
@name("Block writing secrets to files")
@description("Prevents code agents from writing detected secrets to output files")
@severity("critical")
@tags("profile,code-agent,secrets,security")
forbid (
    principal,
    action == Guardrails::Action::"write_file",
    resource
) when {
    context has contains_secrets && context.contains_secrets == true
};
