{
  "policies": [
    "default-action-tiers",
    "default-action-tiers-capped"
  ],
  "definitions": {
    "default-action-tiers": {
      "version": "0.1",
      "name": "fieldproof-default-action-tiers",
      "description": "Reference policy from the Fieldproof Agentic AI Governance Pack: four action tiers, default-deny, money and deletion gated to humans.",
      "default": "deny",
      "tiers": {
        "0": {
          "decision": "allow",
          "label": "read-only"
        },
        "1": {
          "decision": "allow",
          "label": "reversible write"
        },
        "2": {
          "decision": "require_approval",
          "label": "hard to reverse — human approval"
        },
        "3": {
          "decision": "deny",
          "label": "forbidden for agents"
        }
      },
      "rules": [
        {
          "id": "read-anything",
          "match": {
            "action": "*.read"
          },
          "tier": 0,
          "rationale": "Reads are tier 0: no side effects."
        },
        {
          "id": "list-search",
          "match": {
            "action": "*.list"
          },
          "tier": 0
        },
        {
          "id": "vault-list-names",
          "match": {
            "action": "vault.opaque.list"
          },
          "tier": 0,
          "rationale": "Listing vault names is not a secret read."
        },
        {
          "id": "domain-inventory",
          "match": {
            "action": "domain.inventory"
          },
          "tier": 0,
          "rationale": "Read-only domain inventory is separate from DNS or website writes."
        },
        {
          "id": "vault-opaque-write",
          "match": {
            "action": "vault.opaque.write"
          },
          "tier": 1,
          "rationale": "Write a secret into KeePass or the OS store. The value never enters the mesh."
        },
        {
          "id": "vault-opaque-use",
          "match": {
            "action": "vault.opaque.use"
          },
          "tier": 1,
          "rationale": "Invoke a secret by opaque reference. The agent never sees the value."
        },
        {
          "id": "connector-invoke",
          "match": {
            "action": "connector.invoke"
          },
          "tier": 1,
          "rationale": "Approved connectors may be invoked. Fail closed on revoke, expiry, or missing scope."
        },
        {
          "id": "dns-write",
          "match": {
            "action": "dns.write"
          },
          "tier": 1,
          "rationale": "DNS writes need capability, scope, diff, and verification. Separate from website writes."
        },
        {
          "id": "website-create",
          "match": {
            "action": "website.create"
          },
          "tier": 1
        },
        {
          "id": "website-update",
          "match": {
            "action": "website.update"
          },
          "tier": 1
        },
        {
          "id": "account-create-mesh",
          "match": {
            "action": "account.create.mesh"
          },
          "tier": 1,
          "rationale": "Service accounts created for the mesh are for the mesh to operate."
        },
        {
          "id": "no-secret-read",
          "match": {
            "action": "vault.opaque.read"
          },
          "tier": 3,
          "rationale": "Secret values must never be retrieved into the mesh."
        },
        {
          "id": "no-secret-expose",
          "match": {
            "action": "secret.expose"
          },
          "tier": 3,
          "rationale": "Secret values must never appear in prompts, logs, files, or receipts."
        },
        {
          "id": "no-browser-extract",
          "match": {
            "action": "auth.browser.**"
          },
          "tier": 3,
          "rationale": "Browser password extraction remains prohibited."
        },
        {
          "id": "small-payments-need-approval",
          "match": {
            "action": "payments.send",
            "where": [
              {
                "param": "amount_usd",
                "lte": 50
              }
            ]
          },
          "tier": 2,
          "rationale": "Any outbound payment is at least tier 2; small ones may be approved quickly."
        },
        {
          "id": "large-payments-forbidden",
          "match": {
            "action": "payments.send",
            "where": [
              {
                "param": "amount_usd",
                "gt": 50
              }
            ]
          },
          "tier": 3,
          "rationale": "Payments over $50 are outside agent authority entirely."
        },
        {
          "id": "payments-unknown-amount",
          "match": {
            "action": "payments.send"
          },
          "tier": 3,
          "rationale": "Payment with unspecified amount: treat as worst case."
        },
        {
          "id": "no-deletes",
          "match": {
            "action": "**.delete"
          },
          "tier": 3,
          "rationale": "Agents never delete data."
        },
        {
          "id": "no-credentials",
          "match": {
            "action": "auth.**"
          },
          "tier": 3,
          "rationale": "Raw credential values stay out of the mesh. Opaque vault and connector use is a different action family."
        },
        {
          "id": "content-updates-ok",
          "match": {
            "action": "content.update"
          },
          "tier": 1,
          "rationale": "Content edits are versioned and reversible."
        },
        {
          "id": "outbound-messages-first-contact",
          "match": {
            "action": "messages.send",
            "where": [
              {
                "param": "prior_contact",
                "eq": false
              }
            ]
          },
          "tier": 2,
          "rationale": "First contact with a new party is new-in-kind: stage for human approval."
        },
        {
          "id": "outbound-messages-known-thread",
          "match": {
            "action": "messages.send",
            "where": [
              {
                "param": "prior_contact",
                "eq": true
              }
            ]
          },
          "tier": 1
        }
      ]
    },
    "default-action-tiers-capped": {
      "version": "0.1",
      "name": "default-action-tiers-capped",
      "description": "Reference policy from the Fieldproof Agentic AI Governance Pack: four action tiers, default-deny, money and deletion gated to humans.",
      "default": "deny",
      "tiers": {
        "0": {
          "decision": "allow",
          "label": "read-only"
        },
        "1": {
          "decision": "allow",
          "label": "reversible write"
        },
        "2": {
          "decision": "require_approval",
          "label": "hard to reverse — human approval"
        },
        "3": {
          "decision": "deny",
          "label": "forbidden for agents"
        }
      },
      "rules": [
        {
          "id": "cumulative-spend-cap",
          "match": {
            "action": "payments.*",
            "cumulative": [
              {
                "field": "usd",
                "gt": 50
              }
            ]
          },
          "tier": 3,
          "rationale": "Committed plus intended spend in the window is over $50. Individually-approved payments still aggregate, and the per-action rules below cannot see that."
        },
        {
          "id": "read-anything",
          "match": {
            "action": "*.read"
          },
          "tier": 0,
          "rationale": "Reads are tier 0: no side effects."
        },
        {
          "id": "list-search",
          "match": {
            "action": "*.list"
          },
          "tier": 0
        },
        {
          "id": "vault-list-names",
          "match": {
            "action": "vault.opaque.list"
          },
          "tier": 0,
          "rationale": "Listing vault names is not a secret read."
        },
        {
          "id": "domain-inventory",
          "match": {
            "action": "domain.inventory"
          },
          "tier": 0,
          "rationale": "Read-only domain inventory is separate from DNS or website writes."
        },
        {
          "id": "vault-opaque-write",
          "match": {
            "action": "vault.opaque.write"
          },
          "tier": 1,
          "rationale": "Write a secret into KeePass or the OS store. The value never enters the mesh."
        },
        {
          "id": "vault-opaque-use",
          "match": {
            "action": "vault.opaque.use"
          },
          "tier": 1,
          "rationale": "Invoke a secret by opaque reference. The agent never sees the value."
        },
        {
          "id": "connector-invoke",
          "match": {
            "action": "connector.invoke"
          },
          "tier": 1,
          "rationale": "Approved connectors may be invoked. Fail closed on revoke, expiry, or missing scope."
        },
        {
          "id": "dns-write",
          "match": {
            "action": "dns.write"
          },
          "tier": 1,
          "rationale": "DNS writes need capability, scope, diff, and verification. Separate from website writes."
        },
        {
          "id": "website-create",
          "match": {
            "action": "website.create"
          },
          "tier": 1
        },
        {
          "id": "website-update",
          "match": {
            "action": "website.update"
          },
          "tier": 1
        },
        {
          "id": "account-create-mesh",
          "match": {
            "action": "account.create.mesh"
          },
          "tier": 1,
          "rationale": "Service accounts created for the mesh are for the mesh to operate."
        },
        {
          "id": "no-secret-read",
          "match": {
            "action": "vault.opaque.read"
          },
          "tier": 3,
          "rationale": "Secret values must never be retrieved into the mesh."
        },
        {
          "id": "no-secret-expose",
          "match": {
            "action": "secret.expose"
          },
          "tier": 3,
          "rationale": "Secret values must never appear in prompts, logs, files, or receipts."
        },
        {
          "id": "no-browser-extract",
          "match": {
            "action": "auth.browser.**"
          },
          "tier": 3,
          "rationale": "Browser password extraction remains prohibited."
        },
        {
          "id": "small-payments-need-approval",
          "match": {
            "action": "payments.send",
            "where": [
              {
                "param": "amount_usd",
                "lte": 50
              }
            ]
          },
          "tier": 2,
          "rationale": "Any outbound payment is at least tier 2; small ones may be approved quickly."
        },
        {
          "id": "large-payments-forbidden",
          "match": {
            "action": "payments.send",
            "where": [
              {
                "param": "amount_usd",
                "gt": 50
              }
            ]
          },
          "tier": 3,
          "rationale": "Payments over $50 are outside agent authority entirely."
        },
        {
          "id": "payments-unknown-amount",
          "match": {
            "action": "payments.send"
          },
          "tier": 3,
          "rationale": "Payment with unspecified amount: treat as worst case."
        },
        {
          "id": "no-deletes",
          "match": {
            "action": "**.delete"
          },
          "tier": 3,
          "rationale": "Agents never delete data."
        },
        {
          "id": "no-credentials",
          "match": {
            "action": "auth.**"
          },
          "tier": 3,
          "rationale": "Raw credential values stay out of the mesh. Opaque vault and connector use is a different action family."
        },
        {
          "id": "content-updates-ok",
          "match": {
            "action": "content.update"
          },
          "tier": 1,
          "rationale": "Content edits are versioned and reversible."
        },
        {
          "id": "outbound-messages-first-contact",
          "match": {
            "action": "messages.send",
            "where": [
              {
                "param": "prior_contact",
                "eq": false
              }
            ]
          },
          "tier": 2,
          "rationale": "First contact with a new party is new-in-kind: stage for human approval."
        },
        {
          "id": "outbound-messages-known-thread",
          "match": {
            "action": "messages.send",
            "where": [
              {
                "param": "prior_contact",
                "eq": true
              }
            ]
          },
          "tier": 1
        }
      ]
    }
  },
  "note": "Policies are public on purpose: you are paying for the verdict, not the rules. GET /v1/example for worked verdicts."
}