version: "1"

defaults:
  risk_level: medium
  approval: approve

rules:
  # Low-risk: auto-approve all read and get operations
  - name: read_ops
    match:
      type: "read*"
    risk_level: low
    approval: auto

  - name: get_ops
    match:
      type: "get*"
    risk_level: low
    approval: auto

  # Medium-risk: require approval for writes
  - name: write_ops
    match:
      type: "write*"
    risk_level: medium
    approval: approve

  # Critical: block all deletes
  - name: delete_ops
    match:
      type: "delete*"
    risk_level: critical
    approval: block
