diff --git a/src/chezmoi/.chezmoidata/ai/command_policy/bun.toml b/src/chezmoi/.chezmoidata/ai/command_policy/bun.toml
new file mode 100644
index 00000000..8a392536
--- /dev/null
+++ b/src/chezmoi/.chezmoidata/ai/command_policy/bun.toml
@@ -0,0 +1,20 @@
+# Fixed, bounded bun subcommands only. Excluded deliberately:
+#   - install/add/remove/update/link/unlink/patch: mutate deps/lockfile and
+#     can run arbitrary postinstall lifecycle scripts from any involved
+#     package (supply-chain execution risk, not just local mutation).
+#   - create: downloads and runs arbitrary template scaffolding.
+#   - publish: npm registry write, same bar as "git push".
+#   - upgrade: mutates the bun binary itself, not project state.
+#   - run, x/bunx bare, repl, exec: unbounded per-project or ad hoc code
+#     (specific bunx targets like eslint/openspec are allowed individually
+#     elsewhere, not bunx as a whole).
+# "bun test" is the one exception that runs arbitrary project test-file
+# code rather than a fixed operation — kept in deliberately, workflow value
+# judged to outweigh the precedent break.
+[ai.command_policy.commands]
+"bun audit" = "allow"
+"bun build" = "allow"
+"bun info" = "allow"
+"bun outdated" = "allow"
+"bun test" = "allow"
+"bun why" = "allow"
diff --git a/src/chezmoi/.chezmoidata/ai/command_policy/eslint.toml b/src/chezmoi/.chezmoidata/ai/command_policy/eslint.toml
new file mode 100644
index 00000000..182b20d1
--- /dev/null
+++ b/src/chezmoi/.chezmoidata/ai/command_policy/eslint.toml
@@ -0,0 +1,4 @@
+# Read-only linting by default; --fix mutates tracked files but is
+# git-recoverable, same bar as "git add"/"git commit" below.
+[ai.command_policy.commands]
+"bunx eslint" = "allow"
diff --git a/src/chezmoi/.chezmoidata/ai/command_policy/openspec.toml b/src/chezmoi/.chezmoidata/ai/command_policy/openspec.toml
new file mode 100644
index 00000000..90e26c22
--- /dev/null
+++ b/src/chezmoi/.chezmoidata/ai/command_policy/openspec.toml
@@ -0,0 +1,7 @@
+# OpenSpec CLI: local spec-file read/write under a project's openspec/
+# directory, no remote/network write. Three invocation styles seen in the
+# wild for the same tool, each needs its own literal-prefix entry.
+[ai.command_policy.commands]
+"bunx openspec" = "allow"
+"npx openspec" = "allow"
+"openspec" = "allow"