diff --git a/.claude/skills/bitdefender/SKILL.md b/.claude/skills/bitdefender/SKILL.md
index 2512c9b6..c6cea99e 100644
--- a/.claude/skills/bitdefender/SKILL.md
+++ b/.claude/skills/bitdefender/SKILL.md
@@ -94,6 +94,10 @@ what they would do and exit non-zero:
 - `blocklist-remove --id <hashItemId> --confirm`
 - `assign-policy --policy <id> --targets <id> ... --confirm` (applies an existing policy to endpoints/groups)
 - `push-set --status 1 --url <receiver> --confirm` (configures the GravityZone push event service)
+- `move --endpoints <id> ... --group <id> --confirm` (relocating endpoints changes their INHERITED policy — gated 2026-06-25)
+- `scan --targets <id> ... --type <n> --confirm` (starts a scan on live endpoints — gated 2026-06-25)
+- `create-package --name <n> [--company <id>] --confirm` (creates an installer package — gated 2026-06-25)
+- `make-group --name <n> [--parent <id>] --confirm` (creates a custom group — gated 2026-06-25)
 
 Never run destructive calls casually against this tenant. UNVERIFIED methods
 (assignPolicy, uninstall/reconfigure tasks, quarantine remove/restore, set
diff --git a/.claude/skills/bitdefender/scripts/gz.py b/.claude/skills/bitdefender/scripts/gz.py
index 657fb754..f14699b1 100644
--- a/.claude/skills/bitdefender/scripts/gz.py
+++ b/.claude/skills/bitdefender/scripts/gz.py
@@ -1024,31 +1024,37 @@ def build_parser() -> argparse.ArgumentParser:
                         parents=[common])
     sp.add_argument("--refresh", action="store_true", help="Force a full re-pull.")
 
-    sp = sub.add_parser("create-package", help="Create an installer package.",
+    sp = sub.add_parser("create-package", help="Create an installer package (gated).",
                         parents=[common])
     sp.add_argument("--name", required=True)
     sp.add_argument("--company")
     sp.add_argument("--description")
     sp.add_argument("--language")
+    sp.add_argument("--confirm", action="store_true")
 
     sp = sub.add_parser("install-links", help="Get installer download URLs.",
                         parents=[common])
     sp.add_argument("--package", required=True)
     sp.add_argument("--company")
 
-    sp = sub.add_parser("scan", help="Create a scan task.", parents=[common])
+    sp = sub.add_parser("scan", help="Create a scan task (gated).", parents=[common])
     sp.add_argument("--targets", nargs="+", required=True)
     sp.add_argument("--type", type=int, required=True,
                     help="1=Quick 2=Full 3=Memory 4=Custom (verify in console).")
     sp.add_argument("--name")
+    sp.add_argument("--confirm", action="store_true")
 
-    sp = sub.add_parser("move", help="Move endpoints into a group.", parents=[common])
+    sp = sub.add_parser("move", help="Move endpoints into a group (gated).",
+                        parents=[common])
     sp.add_argument("--endpoints", nargs="+", required=True)
     sp.add_argument("--group", required=True)
+    sp.add_argument("--confirm", action="store_true")
 
-    sp = sub.add_parser("make-group", help="Create a custom group.", parents=[common])
+    sp = sub.add_parser("make-group", help="Create a custom group (gated).",
+                        parents=[common])
     sp.add_argument("--name", required=True)
     sp.add_argument("--parent")
+    sp.add_argument("--confirm", action="store_true")
 
     sub.add_parser("endpoint-tags", help="List endpoint tags.", parents=[common])