{
  "itemCount": 4,
  "reviewItems": [
    {
      "kind": "wildcard_allow",
      "question": "Which executable actions can this cover, including repository scripts?",
      "rule": "Bash(git *)"
    },
    {
      "kind": "wildcard_allow",
      "question": "Which executable actions can this cover, including repository scripts?",
      "rule": "Bash(npm run *)"
    },
    {
      "kind": "sandbox_exclusion",
      "question": "Why does this command need to run outside the sandbox?",
      "rule": "docker *"
    },
    {
      "kind": "deny_scope",
      "question": "Command-text rules are not an OS boundary; check alternate invocation forms."
    }
  ],
  "sandboxEnabledInInput": true,
  "scope": "Static local JSON inspection only; no native enforcement tested"
}