I Built a Read-Only kubectl So AI Agents Can't Break My Cluster

Last month I gave Claude access to one of our staging clusters. Within minutes it tried to kubectl...