{
  "apiVersion": "hub.example.com/v1alpha1",
  "kind": "Policy",
  "metadata": {
    "name": "040 Read Tool Allow",
    "slug": "040-read-tool-allow"
  },
  "spec": {
    "priority": 40,
    "description": "Allow R0/R1 calls only when scope, capability pack, connector binding, input budget and output policy all pass.",
    "match": {
      "riskClasses": [
        "R0",
        "R1"
      ]
    },
    "conditions": {
      "requireScope": true,
      "requireCapabilityPack": true,
      "requireConnectorBinding": true,
      "requireInputValidation": true,
      "requireOutputValidation": true,
      "requireRedaction": true
    },
    "decision": "allow_if_conditions",
    "terminal": true
  }
}