Stop an AI agent from nuking your GCP project.You let Claude Code touch your Google Cloud account because it's fast. The problem is the same speed applies to gcloud projects delete, gsutil rm -r, and a stray set-iam-policy that quietly wipes every binding you had. One confidently-wrong tool call and you're restoring from backups — if you have them.This is a drop-in seatbelt. It blocks destructive gcloud, gsutil, and bq commands before they run, and waves safe read-only commands straight through — so the agent stays useful without staying dangerous.## Two layers of protection (both included, pre-wired)- Static deny rules in a settings.json you merge into Claude Code — refused before the command is even proposed.- A PreToolUse hook that reads the actual command at runtime and regex-matches a curated denylist — catching the cases static rules miss: reordered flags, quoting tricks, and public allUsers / allAuthenticatedUsers bindings that silently expose a bucket to the whole internet.When something destructive is caught, the agent gets a clear reason explaining what was blocked and what to do instead — not just a dead end.## What it blocks- Deleting a whole project- Overwriting an IAM policy or removing bindings (lockout / privilege loss)- Deleting service accounts, keys, and custom roles- Making buckets or resources public (`allUsers` / allAuthenticatedUsers)- Recursive storage wipes (`gsutil rm -r`, gsutil rb, gcloud storage rm -r)- Deleting Compute instances, disks, snapshots, networks, firewall rules- Dropping BigQuery datasets/tables (`bq rm`)- Disabling audit logs and logging sinks- A broad gcloud … delete catch-all you can toggleRead commands — list, describe, get-iam-policy, gsutil ls/cat, bq query — pass through untouched.## What's inside- SKILL.md — a real Claude Code skill so the agent can install and reason about the guardrails- settings.json — deny / ask / allow tiers + the PreToolUse wiring- hooks/block-destructive-gcloud.sh — the working hook (`bash` + grep, uses jq if present)- hooks/patterns.txt — the editable regex denylist; extend it for your org- examples/blocked.md and examples/allowed.md — worked walkthroughs- examples/test.sh — 31 assertions that prove the hook blocks/allows correctly- INSTALL.md — 5-step install (project vs global, chmod, wiring, testing, extending)## Who it's forDevelopers and teams running Claude Code against a real GCP project — especially anyone about to point it at production. It's defense-in-depth, not a replacement for least-privilege IAM, but it's the local seatbelt you can drop in this afternoon.## Requirements- Claude Code- bash and grep (every Mac/Linux box has these); jq optional but recommendedTested: 31/31 block/allow assertions pass out of the box. Edit patterns.txt, re-run the tests, ship.