{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://github.com/Acacian/aegis/blob/main/policy.schema.json",
  "title": "Aegis Policy",
  "description": "Schema for Aegis policy YAML/JSON files.",
  "type": "object",
  "required": ["version", "rules"],
  "properties": {
    "version": {
      "type": "string",
      "description": "Policy format version.",
      "enum": ["1"]
    },
    "defaults": {
      "type": "object",
      "description": "Default risk level and approval mode when no rule matches.",
      "properties": {
        "risk_level": {
          "type": "string",
          "enum": ["low", "medium", "high", "critical"],
          "default": "medium"
        },
        "approval": {
          "type": "string",
          "enum": ["auto", "approve", "block"],
          "default": "approve"
        }
      },
      "additionalProperties": false
    },
    "rules": {
      "type": "array",
      "description": "Ordered list of policy rules. First match wins.",
      "items": {
        "type": "object",
        "required": ["match"],
        "properties": {
          "name": {
            "type": "string",
            "description": "Human-readable rule name."
          },
          "match": {
            "type": "object",
            "description": "Glob patterns to match actions.",
            "properties": {
              "type": {
                "type": "string",
                "description": "Glob pattern for action type (e.g. 'read', 'delete*').",
                "default": "*"
              },
              "target": {
                "type": "string",
                "description": "Glob pattern for action target (e.g. 'salesforce', '*').",
                "default": "*"
              }
            },
            "additionalProperties": false
          },
          "risk_level": {
            "type": "string",
            "enum": ["low", "medium", "high", "critical"],
            "default": "medium"
          },
          "approval": {
            "type": "string",
            "enum": ["auto", "approve", "block"],
            "default": "approve"
          }
        },
        "additionalProperties": false
      }
    }
  },
  "additionalProperties": false
}
