shield_name: customer-support
version: "1"
default_verdict: BLOCK
rules:
  - id: block-system
    tool_name: "exec_command"
    then: BLOCK
    message: "System commands blocked for support agents"

  - id: block-file-ops
    tool_name: "write_file"
    then: BLOCK
    message: "File operations blocked for support agents"

  - id: block-delete
    tool_name: "delete_file"
    then: BLOCK
    message: "Delete blocked for support agents"

  - id: allow-crm-read
    tool_name: "crm_lookup"
    then: ALLOW
    message: "CRM lookups allowed"

  - id: allow-ticket-read
    tool_name: "get_ticket"
    then: ALLOW
    message: "Ticket reads allowed"

  - id: approve-account-modify
    tool_name: "update_account"
    then: APPROVE
    message: "Account modifications require supervisor approval"

  - id: approve-refund
    tool_name: "process_refund"
    then: APPROVE
    message: "Refunds require supervisor approval"
