shieldset:
policy:
composite_scoring:
enabled: false
workspace_probe:
enabled: false
decision_memory:
enabled: false
burst_detector:
enabled: false
rules:
- id: sql.drop_database
severity: Critical
points: 6
where: tool_call
match:
tool:
sql_matches:
reason: "DROP DATABASE is never auto-allowed."