Question 70
A coding assistant proposes deleting a protected production configuration file using its shell tool. A repository policy prohibits this path. Where should the restriction be enforced?
Explanation
Correct Answer
The host can block a destructive operation before filesystem changes occur.
Incorrect Answers
Restoration is uncertain and does not justify knowingly executing an unauthorized delete.
Output redaction cannot prevent a harmful operation. The pre-execution hook must validate target path and deny disallowed mutations.
A text reminder is not a security boundary.