From 6eabb06fdfea2e6158e9a3cfba8c2f230b4c27f4 Mon Sep 17 00:00:00 2001 From: Naved Merchant <14171946+navedmerchant@users.noreply.github.com> Date: Sun, 2 Aug 2026 20:19:55 +0000 Subject: [PATCH] docs: explain destructive command guard --- docs/features/auto-approving-actions.mdx | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/docs/features/auto-approving-actions.mdx b/docs/features/auto-approving-actions.mdx index 87e2cbb7..e30e3cc4 100644 --- a/docs/features/auto-approving-actions.mdx +++ b/docs/features/auto-approving-actions.mdx @@ -92,6 +92,19 @@ The dropdown shows a grid of permission tiles. Controls: --- +### Destructive Command Guard + +The **Enable destructive command guard** setting is available under the **Execute** permission in Auto-Approve Settings. When the Execute permission and this setting are enabled, Zoo evaluates terminal commands with Destructive Command Guard (DCG) before running them automatically. + +- Commands allowed by DCG run automatically. +- Commands blocked by DCG show the matched reason or rule and require an explicit one-time decision. +- Choosing **Deny** does not run the command; choosing **Approve** runs that command once. +- While DCG is enabled, Zoo's allowed and denied command-prefix lists do not apply. + +Zoo verifies the DCG download when you enable the setting. If DCG is unavailable for your platform or cannot be installed, Zoo leaves the setting disabled and shows an error. + +--- + ## Global Enabled Switch Auto-Approve dropdown; Enabled at bottom-right and All/None chips at bottom-left