◇ Could this help me?
Yes. This is the correct mechanism to rely on, because it is enforced outside the model: a deny rule stops the tool call regardless of what the model decided to do, which is exactly the property that instructions in a prompt do not have. Configuring deny rules for the files and commands an agent should never touch is one of the cheapest safety improvements available in an agentic dev setup. General practice, with one boundary worth knowing: deny rules cover the actions they match, so they narrow the blast radius rather than sandboxing the agent, and they are not a substitute for withholding access to genuinely dangerous credentials or environments.
Help me set up permission deny rules for this project so the coding agent cannot touch things it has no business changing. First, list the files, directories, and commands in this repository that an agent should never modify or run, and explain the risk in each case. Then write the deny rules that block them, and give me a specific test for each one: a request I can make that should be refused, so I can confirm the rule actually fires. Finally, tell me what these rules do not protect against, so I know where the boundary is.