Let agents pause and ask before running a migration

Agents can already run terminal commands with approval. I would like a list of command patterns that always require approval, even in auto-run mode, for things like db:migrate, terraform apply or rm -rf.