Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

catalog/policies/041-appops-governed-operations.yaml

@@ -0,0 +1,27 @@
+{
+  "apiVersion": "hub.example.com/v1alpha1",
+  "kind": "Policy",
+  "metadata": {"name": "041 AppOps Governed Operations", "slug": "041-appops-governed-operations"},
+  "spec": {
+    "priority": 41,
+    "description": "Allow only bounded typed AppOps mutations after Hub identity, binding and AppOps exact-target policy checks; no generic shell, Docker socket or human-approval bypass is introduced.",
+    "match": {
+      "project": "server-ops",
+      "environmentClassifications": ["production"],
+      "connectors": ["appops"],
+      "riskClasses": ["R2", "R3"],
+      "toolPatterns": [
+        "server.operation.request",
+        "server.operation.execute",
+        "server.job.cancel",
+        "server.project.reconcile",
+        "server.deployment.target.enroll",
+        "server.deployment.apply",
+        "server.deployment.rollback"
+      ]
+    },
+    "conditions": {"requireEnabledClient": true, "requireBinding": true, "maxArgumentBytes": 65536},
+    "decision": "allow_if_conditions",
+    "terminal": true
+  }
+}