Pack

`ops-approve`

terraform apply, kubectl apply, docker push — require approval.

Default effect: require approval

Extend in policy

extends:
  - pack: ops-approve

Optional pack for infra / cluster / container mutations. Stack on top of dangerous-defaults.