{
  "$id": "https://capitalguard.io/policy/v0.1.0/policy.schema.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "additionalProperties": false,
  "properties": {
    "defaultDecision": {
      "const": "block"
    },
    "policyId": {
      "pattern": "^CGPOL-[A-Z0-9][A-Z0-9-]{2,90}$",
      "type": "string"
    },
    "rules": {
      "items": {
        "additionalProperties": false,
        "properties": {
          "actorIds": {
            "items": {
              "pattern": "^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,95}$",
              "type": "string"
            },
            "maxItems": 32,
            "type": "array",
            "uniqueItems": true
          },
          "commandArgumentDigests": {
            "items": {
              "pattern": "^[a-f0-9]{64}$",
              "type": "string"
            },
            "maxItems": 32,
            "type": "array",
            "uniqueItems": true
          },
          "commandExecutables": {
            "items": {
              "pattern": "^[a-z0-9][a-z0-9._+-]{0,95}$",
              "type": "string"
            },
            "maxItems": 32,
            "type": "array",
            "uniqueItems": true
          },
          "contextTrust": {
            "items": {
              "enum": [
                "reviewed",
                "trusted",
                "unknown",
                "untrusted"
              ]
            },
            "maxItems": 32,
            "type": "array",
            "uniqueItems": true
          },
          "dataClassifications": {
            "items": {
              "enum": [
                "confidential",
                "internal",
                "public",
                "restricted",
                "unknown"
              ]
            },
            "maxItems": 32,
            "type": "array",
            "uniqueItems": true
          },
          "effect": {
            "enum": [
              "allow",
              "block",
              "redact",
              "require_approval",
              "simulate"
            ]
          },
          "enforceability": {
            "enum": [
              "advisory",
              "enforced",
              "partially_enforceable"
            ]
          },
          "environments": {
            "items": {
              "enum": [
                "ci",
                "local",
                "production",
                "staging",
                "unknown"
              ]
            },
            "maxItems": 32,
            "type": "array",
            "uniqueItems": true
          },
          "id": {
            "pattern": "^CGP-[A-Z0-9][A-Z0-9-]{2,91}$",
            "type": "string"
          },
          "mcpServers": {
            "items": {
              "pattern": "^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,95}$",
              "type": "string"
            },
            "maxItems": 32,
            "type": "array",
            "uniqueItems": true
          },
          "mcpTools": {
            "items": {
              "pattern": "^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,95}$",
              "type": "string"
            },
            "maxItems": 32,
            "type": "array",
            "uniqueItems": true
          },
          "mcpArgumentDigests": {
            "items": {
              "pattern": "^[a-f0-9]{64}$",
              "type": "string"
            },
            "maxItems": 32,
            "type": "array",
            "uniqueItems": true
          },
          "networkHosts": {
            "items": {
              "type": "string"
            },
            "maxItems": 32,
            "type": "array",
            "uniqueItems": true
          },
          "networkMethods": {
            "items": {
              "const": "HEAD"
            },
            "maxItems": 32,
            "type": "array",
            "uniqueItems": true
          },
          "operations": {
            "items": {
              "enum": [
                "agent.handoff",
                "command.execute",
                "file.read",
                "file.write",
                "mcp.tool.invoke",
                "network.connect"
              ]
            },
            "maxItems": 6,
            "minItems": 1,
            "type": "array",
            "uniqueItems": true
          },
          "pathGlobs": {
            "items": {
              "type": "string"
            },
            "maxItems": 32,
            "type": "array",
            "uniqueItems": true
          },
          "priority": {
            "maximum": 10000,
            "minimum": 0,
            "type": "integer"
          },
          "reason": {
            "maxLength": 240,
            "minLength": 1,
            "type": "string"
          },
          "requireTaskId": {
            "type": "boolean"
          },
          "targetAgentIds": {
            "items": {
              "pattern": "^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,95}$",
              "type": "string"
            },
            "maxItems": 32,
            "type": "array",
            "uniqueItems": true
          },
          "toolIds": {
            "items": {
              "pattern": "^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,95}$",
              "type": "string"
            },
            "maxItems": 32,
            "type": "array",
            "uniqueItems": true
          }
        },
        "required": [
          "effect",
          "enforceability",
          "id",
          "operations",
          "priority",
          "reason"
        ],
        "type": "object"
      },
      "maxItems": 128,
      "minItems": 1,
      "type": "array"
    },
    "schemaVersion": {
      "const": "cg-policy-0.1.0"
    },
    "version": {
      "pattern": "^\\d+\\.\\d+\\.\\d+(?:-[a-z0-9.-]+)?$",
      "type": "string"
    }
  },
  "required": [
    "defaultDecision",
    "policyId",
    "rules",
    "schemaVersion",
    "version"
  ],
  "title": "CapitalGuard Policy Language 0.1",
  "type": "object"
}