Block TRUNCATE TABLE with DestructGuard
Configure DestructGuard to block TRUNCATE TABLE using the strict tier.
TRUNCATE TABLE
Blast radius
Every row in the targeted table(s), plus identity sequences reset to their initial values. No WHERE clause is allowed. Triggers do not fire for most engines (Postgres TRUNCATE fires statement-level triggers; MySQL/SQL Server fire none). Foreign-key cascade behavior is engine-specific.
Why agents reach for it
Agents reach for it when the task includes 'clear test data', 'reset between runs', or 'remove old logs' — and the table name they pass happens to be the production analog of a dev table.
Recovery options
In PostgreSQL and SQL Server, TRUNCATE can be rolled back inside an explicit transaction. In MySQL InnoDB it's auto-committing DDL with no rollback. Recovery from a committed TRUNCATE requires a full backup restore, point-in-time-recovery, or binlog replay if positioned before the TRUNCATE statement.
Real-world incident
A coding agent ran `TRUNCATE users;` inside a script meant for the staging DB but pointed at production via a leaked DATABASE_URL. The identity-sequence reset broke FK relationships in the orders table that took 6 hours to reconstruct.
Block it with DestructGuard's strict tier
DestructGuard's strict rules tier includes TRUNCATE TABLE by default — the call is intercepted at the shell or process boundary before execution. Approvals are logged to JSONL with timestamp, caller, command, and decision. Pair with git pre-commit and pre-push hooks from the Pro Pack so destructive patterns are blocked at multiple points in the agent pipeline.
From guidance to an enforceable agent loop
Preflight this command before an agent executes it
Start with the one-cent Action Safety Quick Gate. Low risk can proceed, medium risk routes to full DestructGuard evidence, and high or critical risk routes to the complete workflow for ReviewQueue triage, a signed receipt, and a privacy-preserving status record. Triage never implies human approval.