{
  "apiVersion": "hub.example.com/v1alpha1",
  "kind": "Policy",
  "metadata": {
    "name": "035 Gitea Controlled Writes V1.1",
    "slug": "035-gitea-controlled-writes-v1-1"
  },
  "spec": {
    "priority": 35,
    "description": "Allow the bounded Gitea R2 operations for the registered or account-discovered gitea-all production project and an enabled bound client.",
    "match": {
      "project": "gitea-all",
      "environmentClassifications": ["production"],
      "connectors": ["gitea"],
      "riskClasses": ["R2"],
      "toolPatterns": [
        "gitea.repository.create",
        "gitea.branchprotection.ensure",
        "gitea.portfolio.governance.apply",
        "gitea.branch.create",
        "gitea.issue.create",
        "gitea.issue.update",
        "gitea.issue.comment.create",
        "gitea.file.create",
        "gitea.file.update",
        "gitea.file.delete",
        "gitea.pullrequest.create",
        "gitea.pullrequest.update",
        "gitea.pullrequest.close",
        "gitea.pullrequest.validation.ensure",
        "gitea.changeset.apply",
        "gitea.validation.run",
        "gitea.workspace.run",
        "gitea.orchestration.start"
      ]
    },
    "conditions": {
      "requireEnabledClient": true,
      "requireBinding": true,
      "maxArgumentBytes": 1200000
    },
    "decision": "allow_if_conditions",
    "terminal": true
  }
}