{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://schemas.orbiplex.dev/capability-authorization-policy.v1.schema.json",
  "title": "Capability Authorization Policy v1",
  "type": "object",
  "required": ["schema/v", "policy/id", "registry/ref", "entries"],
  "additionalProperties": false,
  "properties": {
    "schema/v": { "const": "capability-authorization-policy.v1" },
    "policy/id": {
      "type": "string",
      "pattern": "^policy:capability-authorization:[A-Za-z0-9_.:-]+$"
    },
    "registry/ref": { "const": "capability-registry.v1" },
    "entries": {
      "type": "array",
      "minItems": 1,
      "items": { "$ref": "#/$defs/entry" }
    }
  },
  "$defs": {
    "entry": {
      "type": "object",
      "required": [
        "capability/id",
        "required/grants",
        "caller/posture",
        "approval/mode",
        "autonomy/floor",
        "coi/policy"
      ],
      "additionalProperties": false,
      "properties": {
        "capability/id": {
          "type": "string",
          "minLength": 1,
          "description": "Canonical capability id. Registry existence and status are checked by capability-registry tooling."
        },
        "required/grants": {
          "type": "array",
          "minItems": 1,
          "uniqueItems": true,
          "items": {
            "type": "string",
            "pattern": "^grant/[^\\s]+$"
          }
        },
        "caller/posture": {
          "enum": [
            "host-grant-required",
            "operator-confirmation-required",
            "host-broker-grant-required"
          ]
        },
        "approval/mode": {
          "enum": [
            "auto-with-grant",
            "operator-approved-by-default",
            "operator-only"
          ]
        },
        "autonomy/floor": {
          "enum": [
            "read-only",
            "observation-only",
            "proposed-effect",
            "bounded-auto"
          ]
        },
        "coi/policy": {
          "enum": [
            "not-applicable",
            "declaration-required",
            "operator-review-required"
          ]
        },
        "allowed/actions": {
          "type": "array",
          "uniqueItems": true,
          "items": {
            "type": "string",
            "maxLength": 128,
            "pattern": "^[a-z][a-z0-9.-]*$"
          },
          "description": "Optional closed action allowlist enforced within a capability. Omission keeps action-level policy outside this entry."
        },
        "notes": { "type": "string", "minLength": 1 }
      }
    }
  }
}