{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/sealgate-ai/json-schema/sealgate-ai-policy-rule-schema.json",
  "title": "PolicyRule",
  "description": "A CEL-based policy rule.",
  "x-generated": "2026-10-30",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/sealgate-ai-management-openapi.json#/components/schemas/PolicyRule",
  "type": "object",
  "properties": {
    "id": {
      "type": "integer",
      "description": "Database row ID"
    },
    "rule_id": {
      "type": "string",
      "description": "Unique rule identifier"
    },
    "name": {
      "type": "string",
      "description": "Human-readable rule name"
    },
    "description": {
      "type": [
        "string",
        "null"
      ]
    },
    "cel_expression": {
      "type": [
        "string",
        "null"
      ],
      "description": "CEL filter expression"
    },
    "phase": {
      "type": "string",
      "default": "pre",
      "description": "Evaluation phase: pre or post"
    },
    "status": {
      "type": "string",
      "default": "enabled",
      "description": "Rule status: enabled, disabled, or tentative"
    },
    "priority": {
      "type": "integer",
      "default": 0,
      "description": "Rule priority (higher evaluated first)"
    },
    "domain": {
      "type": [
        "string",
        "null"
      ],
      "description": "Domain scope (null = global)"
    },
    "principal_scope": {
      "$ref": "#/$defs/PrincipalScope"
    },
    "resource_scope": {
      "$ref": "#/$defs/ResourceScope"
    },
    "actions": {
      "type": "array",
      "items": {
        "$ref": "#/$defs/PolicyAction"
      }
    },
    "created_at": {
      "type": "string",
      "format": "date-time"
    },
    "updated_at": {
      "type": "string",
      "format": "date-time"
    }
  },
  "required": [
    "id",
    "rule_id",
    "name",
    "phase",
    "status",
    "priority",
    "principal_scope",
    "resource_scope",
    "actions",
    "created_at",
    "updated_at"
  ],
  "$defs": {
    "PolicyAction": {
      "type": "object",
      "properties": {
        "action_type": {
          "type": "string",
          "description": "Action type: block, require_approval, allow_override, mark_private, mark_untrusted, mark_write, set_acl, add_tag"
        },
        "acl_level": {
          "type": [
            "string",
            "null"
          ],
          "description": "ACL level for set_acl action"
        },
        "tag_key": {
          "type": [
            "string",
            "null"
          ]
        },
        "tag_value": {
          "type": [
            "string",
            "null"
          ]
        },
        "block_reason": {
          "type": [
            "string",
            "null"
          ]
        },
        "approval_reason": {
          "type": [
            "string",
            "null"
          ],
          "description": "Plain-language reason shown to the human deciding"
        },
        "approval_channels": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Channels to pin the approval prompt to"
        },
        "approval_timeout_s": {
          "type": [
            "number",
            "null"
          ],
          "description": "How long to hold the call awaiting a decision; null uses the server default"
        },
        "approval_on_timeout": {
          "type": [
            "string",
            "null"
          ],
          "enum": [
            "deny",
            "allow",
            null
          ],
          "description": "What happens when nobody answers in time; null means deny (fail closed). 'allow' is deprecated and reported as 'deny'"
        }
      },
      "required": [
        "action_type"
      ]
    },
    "PrincipalScope": {
      "type": "object",
      "properties": {
        "is_global": {
          "type": "boolean",
          "default": true,
          "description": "Whether the rule applies to all users"
        },
        "include_roles": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "include_users": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "exclude_roles": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "exclude_users": {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      }
    },
    "ResourceScope": {
      "type": "object",
      "properties": {
        "element_types": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Element types: tool, resource, prompt"
        },
        "servers": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "MCP server names"
        },
        "name_patterns": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Regex patterns for element names"
        }
      }
    }
  }
}