diff --git a/app/docs/policies/builtin/page.mdx b/app/docs/policies/builtin/page.mdx
index 163bf63..7409dd0 100644
--- a/app/docs/policies/builtin/page.mdx
+++ b/app/docs/policies/builtin/page.mdx
@@ -32,7 +32,7 @@ All builtin policies live under `omnigent.policies.builtins`.
 | `enforce_sandbox`                 | Forces a sandbox configuration on agent start.                                                                                                                                                                                                                                                                                                | `sandbox_type`, `allow_network`, `write_paths`, `read_paths`                                                                                                                                                   |
 | `gcalendar_policy`                | Controls Google Calendar. Defaults to read-only.                                                                                                                                                                                                                                                                                              | None                                                                                                                                                                                                           |
 | `gdrive_policy`                   | Controls Google Drive, Docs, Sheets, and Slides access. Writes restricted to agent-created files by default. Optionally enforces Bell-LaPadula "no write-down": once the session reads a confidential file, its writes are confined to that set.                                                                                              | `read_all`, `allow_create`, `write_files`, `read_files`, `comment_files`, `confidential_files` (string[]), `write_down_action` (`"DENY"` or `"ASK"`, default `"DENY"`)                                         |
-| `github_policy`                   | Controls GitHub read/write access across MCP tools and shell commands. Irreversible destructive operations (deletes) are denied by default even on allowed repos, unless `allow_destructive` is set.                                                                                                                                          | `read_all`, `write_repos`, `write_branches`, `allow_destructive` (bool, default `false`)                                                                                                                       |
+| `github_policy`                   | Controls GitHub read/write access across MCP tools and shell commands. Irreversible destructive operations (deletes) are denied by default even on allowed repos, unless `allow_destructive` is set. `git push` force flags (`--force`, `-f`, `--force-with-lease`, `--force-if-includes`), bundled short flags containing `f` (e.g. `-uf`), and `+refspec` force prefixes are denied by default regardless of the repo/branch allowlists, unless `deny_force_push` is set to `false`.                                                                                                                                          | `read_all`, `write_repos`, `write_branches`, `allow_destructive` (bool, default `false`), `deny_force_push` (bool, default `true`)                                                                                                                       |
 | `gmail_policy`                    | Controls Gmail. Defaults to read + draft, no send.                                                                                                                                                                                                                                                                                            | `allow_read`, `allow_send`, `allow_drafts`                                                                                                                                                                     |
 | `intent_based_authorization`      | Records the first user message as the session's intent, then ASKs before any tool call that has no plausible connection to that intent. Requires an `llm:` config block; fails open when none is available.                                                                                                                                   | None                                                                                                                                                                                                           |
 | `max_tool_calls_per_session`      | DENYs after a total tool-call limit is reached.                                                                                                                                                                                                                                                                                               | `limit` (int, default `100`)                                                                                                                                                                                   |